https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79704#M16366 <P>we have splunk main and four splunk universal forwarders.I do not have access to physical box of splunk main which was maintained by some other admins from different group .everytime I have to request the folks to copy the transforms and props files to right folder on splunk main server (/splunk\etc\apps\appnamePOC\local). <BR /> can I place these files on my splunkuniversalforwarder machines rather asking admin to copy on splunk main folders <BR /> All I need is palce the files to splunkforwarder\etc\apps\appnamePOC\local. will that work?</P> Wed, 20 Jun 2012 14:45:59 GMT splunkatl 2012-06-20T14:45:59Z https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79704#M16366 <P>we have splunk main and four splunk universal forwarders.I do not have access to physical box of splunk main which was maintained by some other admins from different group .everytime I have to request the folks to copy the transforms and props files to right folder on splunk main server (/splunk\etc\apps\appnamePOC\local). <BR /> can I place these files on my splunkuniversalforwarder machines rather asking admin to copy on splunk main folders <BR /> All I need is palce the files to splunkforwarder\etc\apps\appnamePOC\local. will that work?</P> Wed, 20 Jun 2012 14:45:59 GMT https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79704#M16366 splunkatl 2012-06-20T14:45:59Z https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79705#M16367 <P>This will not work. The universal forwarder does not parse data and your props/transforms will be ignored, as they happen where data is parsed. This happens at 1) a heavy forwarder, or 2) an indexer. </P> Wed, 20 Jun 2012 15:51:05 GMT https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79705#M16367 jbsplunk 2012-06-20T15:51:05Z https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79706#M16368 <P>Thank you for quick response.</P> Wed, 20 Jun 2012 16:08:14 GMT https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79706#M16368 splunkatl 2012-06-20T16:08:14Z https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79707#M16369 <P>Glad to be able to help clear things up for you.</P> Wed, 20 Jun 2012 16:09:20 GMT https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79707#M16369 jbsplunk 2012-06-20T16:09:20Z https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79708#M16370 <P>So how would you tell the indexer to only apply a props/transforms to a particular monitor on a particular universal forwarder?</P> Tue, 15 Jul 2014 16:49:51 GMT https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79708#M16370 Strunk 2014-07-15T16:49:51Z https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79709#M16371 <P>Props.conf (and subsequently) applies to a particular sourcetype( or source/host). You have ensure that universal forwarder -&gt;inputs.conf have correct sourcetype (or any other) assignment.</P> Tue, 15 Jul 2014 16:54:06 GMT https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79709#M16371 somesoni2 2014-07-15T16:54:06Z https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79710#M16372 <P>Indexed_extractions must be done on the universal forwarder. This answer is for folks using indexed_extractions only. If you're struggling getting your props to work, you might consider placing it on the UF now.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Configurationparametersandthedatapipeline" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Configurationparametersandthedatapipeline</A></P> <P>Data pipeline phase --- Components that can perform this role<BR /> Input --- indexer , universal forwarder , heavy forwarder<BR /> Parsing ---- indexer, heavy forwarder, light/universal forwarder (in conjunction with the INDEXED_EXTRACTIONS attribute only)<BR /> Indexing ---indexer<BR /> Search ---indexer,search head</P> Tue, 29 Sep 2020 08:04:38 GMT https://community.splunk.com/t5/Getting-Data-In/Transforms-and-props-files-on-splunk-universal-forwarder/m-p/79710#M16372 jkat54 2020-09-29T08:04:38Z