topic Re: Splunk Docker - Which is the right folder for props.conf (and other config files) in Getting Data In

Splunk Docker - Which is the right folder for props.conf (and other config files)

pmcl77 — Tue, 21 Dec 2021 16:54:52 GMT

Hi,

I have found several locations with a props.conf in my Docker splunk:8.2 image:

./opt/splunk/etc/apps/legacy/default/props.conf ./opt/splunk/etc/apps/search/local/props.conf ./opt/splunk/etc/apps/search/default/props.conf ./opt/splunk/etc/apps/splunk_internal_metrics/default/props.conf ./opt/splunk/etc/apps/splunk_monitoring_console/default/props.conf ./opt/splunk/etc/apps/sample_app/default/props.conf ./opt/splunk/etc/apps/SplunkLightForwarder/default/props.conf ./opt/splunk/etc/apps/splunk_archiver/default/props.conf ./opt/splunk/etc/apps/splunk_secure_gateway/default/props.conf ./opt/splunk/etc/apps/splunk_rapid_diag/default/props.conf ./opt/splunk/etc/apps/splunk_instrumentation/default/props.conf ./opt/splunk/etc/apps/learned/local/props.conf ./opt/splunk/etc/system/default/props.conf

I noticed, when I add a sourcetype in splunk Enterprise web interface (Settings -> sourcetypes) they will be saved in two locations:

apps/search/local/props.conf

apps/search/metadata/local.meta

I was just wondering, if any of these two would be right location to copy a manually configured props.conf file, or if I should rather add it to /opt/splunk/etc/system/default/props.conf instead?

Thanks

Re: Splunk Docker - Which is the right folder for props.conf (and other config files)

Stefanie — Tue, 21 Dec 2021 18:03:23 GMT

Hi! Never modify anything in the default directories! These can be used as a baseline to make configuration changes in the local directories however.

Generally, Splunk doesn't mind where you make changes at.

Most configuration changes made through the web UI will make changes in the /opt/splunk/etc/system/local/ directory OR the apps/search/local/props.conf as you saw.

In practice, most Splunk admins prefer to have an app (located in /opt/splunk/etc/apps/) to manage their configurations. This makes it easy to install those apps to other Splunk servers.

Re: Splunk Docker - Which is the right folder for props.conf (and other config files)

pmcl77 — Tue, 21 Dec 2021 19:09:25 GMT

Thank you @Stefanie

Great input, I have read about the concepts of creating an app for configuration in another post but I am not yet at that stage 🙂 I am still experimenting how to correctly getting the data in and then how to make reports for that. But I will keep that in mind and will try to figure that out once I am more familiar with the basics.

Best,

Re: Splunk Docker - Which is the right folder for props.conf (and other config files)

Stefanie — Tue, 21 Dec 2021 19:58:34 GMT

You may have already read this, but this talks about it more in depth:

https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/Configurationfiledirectories