Advanced Deployments - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 358

• All instances should receive these apps:
props-web
local/props.conf
[web_access]
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N %:z
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = False
TRANSFORMS-squashpassword = squashpassword
[web_error]
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N %:z
MAX_TIMESTAMP_LOOKAHEAD = 32
TRANSFORMS-squashpassword = squashpassword
local/transforms.conf
[squashpassword]
REGEX = (?mi)^(.*)password[=:][^,&]+$
FORMAT = $1password=########$2
DEST_KEY = _raw
props-app
local/props.conf
[app1]
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{1,2}-\d{1,2}\s+\d{1,2}:\d{1,2}
[app2]
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{1,2}-\d{1,2}\s+\d{1,2}:\d{1,2}
props-db
local/props.conf
[db_error]
MAX_TIMESTAMP_LOOKAHEAD = 25
props-west
local/props.conf
[db_error]
TZ = PST
[web_error]