Is it necessary to set LINE_BREAKER, TIME_FORMAT, TIME_PREFIX in props.conf for Splunk DB Connect sources?

[lumpymilk]

According to Best Practices for App building , we should at minimum set:
TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD, TIME_FORMAT, LINE_BREAKER, SHOULD_LINEMERGE, TRUNCATE, KV_MODE

So normally for a sourcetype, I would set these basic configurations in props.conf to help Splunk parse data during indexing. I'm wondering if this is even necessary when I'm using a Splunk DB Connect 2 or Splunk DB Connect 3 add-on to load the data. It seems that we already set these when we are creating the db input.

[maraman_splunk · Accepted solution]

Yes, it's best practice to set index time parameters even when the data is collected via dbconnect
For example, in Splunk addon for Mcafee , which collect epo via dbconnect , you'll find

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\s+
MAX_TIMESTAMP_LOOKAHEAD=21
TIME_FORMAT=%Y-%m-%d %H:%M:%S
TZ=UTC

Failure to set TZ for example will make events appear in wrong timezone
Setting the parameters will also improve index time performance.

You can also set TRUNCATE to a higher value than default depending on your data and NO_BINARY_CHECK = true
you should set KVMODE =auto (which is search time config) as data written by dbconnect is in key = value format

[adonio]

db data is already in a table format, which count for the line breaking, should linemerge, etc.
you set the time field based on a field (column name in inputs) and therefore you dont need the time configs e.g. time prefix, max timestamp and more.
pay attention splunk recognizes the timestamp correctly when you are previewing your inputs
hope it helps