topic Re: Props and Transforms doubt in Getting Data In

Props and Transforms doubt

Karthikeya — Sat, 16 Nov 2024 11:21:13 GMT

I am new to Splunk admin and please explain this following stanzas:

We have a dedicated syslog server which receives the logs from network devices and UF installed on the server forwards the data to our cluster manager. These configs are in cluster manager under manager apps.

Re: Props and Transforms doubt

sainag_splunk — Tue, 12 Nov 2024 23:57:23 GMT

Data Flow:

Data goes DIRECTLY from UF to indexers on port 9997 (not to cluster manager)

Cluster Manager only handles configuration distribution

Configuration Management:

Props and transforms configs are deployed via cluster manager

These configs are pushed to index peers via index cluster bundle

Processing Location:

All parsing happens on the indexers (index peers)

Each indexer applies the deployed configurations independently

For Deep Understanding: Refer: https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platform-the-Masa/m-p/590774

Review props.conf documentation: docs.splunk.com/Documentation/Splunk/9.1.0/Admin/Propsconf
docs.splunk.com/Documentation/ITSI/4.17.0/Configure/transforms.conf

Since there are many pipeline components, I encourage you to read through these resources for a complete understanding.

Simple Data Flow here.

If this Helps, Please Upvote.

Re: Props and Transforms doubt

Karthikeya — Wed, 13 Nov 2024 07:26:16 GMT

Thank you @sainag_splunk ..

Then what about inputs.conf and outputs.conf (i believe it will not be there considering it's indexer) in indexer cluster should be configured?

We have deployment server as well. Can you please let me know where it will be there in picture?

Re: Props and Transforms doubt

Karthikeya — Sat, 16 Nov 2024 06:24:11 GMT

Hi @sainag_splunk ,

Also please explain what is index peers you mean and index cluster bundle?

Please reply

Re: Props and Transforms doubt

sainag_splunk — Mon, 18 Nov 2024 16:31:32 GMT

@Karthikeya Index peers are simply indexers that work together in a Splunk cluster environment. They are responsible for receiving, processing, and storing data while maintaining copies across multiple indexers for redundancy and high availability. When a Cluster Master pushes configuration changes through an index cluster bundle, all index peers receive the same settings to ensure consistent operation across the cluster.

Refer: https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Basicclusterarchitecture
https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Howclusteredindexingworks

If this Helps, Please Upvote and Mark as solved.