Splunk Web data preview
The Splunk Web data preview, Add Data, and Upload features are useful for testing the source type settings defined according to the props.conf specification. This works for the [<source type>] stanza.
Why is this so important? For example, say you create a new source type with line-breaking and timestamp extraction settings through a text editor or the New Source Type option available on Splunk Web at Settings | Source types and deploy it. Afterward, you realize the data indexed is not correctly formatted. You have to troubleshoot and find the invalid setting and then redo the same deployment again and again until everything is right. It is tedious, isn’t it? The data preview feature comes in handy for testing the source type and transforms.conf settings. The transforms.conf settings cannot be directly tested in the UI; however, we could pre-create them and refer to them when testing the source type settings. Remember that transforms.conf stanzas...
