topic Re: Why doesn't my Ingest Action work? in Getting Data In

Why doesn't my Ingest Action work?

gerrysr6 — Wed, 10 Jan 2024 17:56:18 GMT

I have written and tested some rules using "Ingest Actions". I used the "Sample" indexed data and everything seems fine, so I saved my rules.

There is a button "Deploy" with one option, Export for Manual Deployment.

Do I have to do that?

Re: Why doesn't my Ingest Action work?

richgalloway — Wed, 10 Jan 2024 18:45:00 GMT

Yes, you must deploy Ingest Actions to the indexers for them to work. See https://docs.splunk.com/Documentation/Splunk/9.1.2/Data/DataIngest#Deploy_a_ruleset_on_an_indexer_cluster

Re: Why doesn't my Ingest Action work?

Esky73 — Sun, 25 Feb 2024 23:45:14 GMT

Do you need to deploy to indexers (as well) ? when there is an intermediary HF ?
All my config is on a HF

Re: Why doesn't my Ingest Action work?

richgalloway — Mon, 26 Feb 2024 01:03:53 GMT

A unique feature of Ingest Actions is that they apply to cooked data. That means they can be installed on indexers and still work on events that come from an HF.

Re: Why doesn't my Ingest Action work?

charleswatts — Fri, 11 Apr 2025 20:16:27 GMT

I see your answer as "Yes" and reference a Splunk Enterprise doc. Can you give an answer for the Splunk Cloud Platform. While I see the deploy button in the top right, I do not see where i can edit the props.conf and the transforms.conf files or is cloud different?

Re: Why doesn't my Ingest Action work?

richgalloway — Fri, 11 Apr 2025 20:48:43 GMT

There's no need to edit props or transforms for Ingest Actions as they can be configured easily using the UI. In fact, use of the UI is recommended to avoid errors in the ruleset config. If you need to edit the config files for Splunk Cloud, do so in a custom app and upload the app to your Splunk Cloud search head.

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Data/DataIngest#Deploy_a_ruleset_on_an_indexer_cluster