topic Re: Help for basic questions concerning props.conf and transforms.conf in forwarder and indexer in Getting Data In

Help for basic questions concerning props.conf and transforms.conf in forwarder and indexer

jip31 — Mon, 30 Aug 2021 10:39:37 GMT

Hello

I develop a Splunk apps on a DEV platform

In this apps, I am doing field extractions and log file parsing.

As a consequence, props.conf and transforms.conf files are regularly modified.

If I want that my Splunk apps works fine in Production, do I have also to update props.conf and transforms.conf in my forwarder? Or on my indexer? Or both in forwarder and indexer ?

Thanks a lot

Re: Help for basic questions concerning props.conf and transforms.conf in forwarder and indexer

richgalloway — Mon, 30 Aug 2021 11:51:36 GMT

It depends. For search-time props the settings must be installed on a search head. Other settings go on the indexer. If the forwarder is a heavy forwarder then the same settings go there as well. Some settings, such as EVENT_BREAKER, go on universal forwarders.

See https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for more information.