When getting new data into Splunk, it helps to be familiar with the index-time pipeline, and how you can use the order of props.conf configs to modify and optimize your data. We created this cheat sheet to help people remember that order.

PDF

PNG

Updated: