topic Where do I edit props.conf in a cluster? in Getting Data In

Where do I edit props.conf in a cluster?

stevennoble — Wed, 23 Oct 2013 02:58:51 GMT

If I'm using an index time props.conf setting (in this case SEDCMD) do I edit props.conf on the master or do I have to edit all of the indexers?

Re: Where do I edit props.conf in a cluster?

jkerai — Wed, 23 Oct 2013 03:26:43 GMT

You can edit props.conf in $SPLUNK_HOME/etc/master-apps/_cluster/local/props.conf on master and push cluster-bundle with command 'splunk apply cluster-bundle'. Peers will restart and props.conf, in $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf, will be layered when splunkd start.

Re: Where do I edit props.conf in a cluster?

dishasaxena — Wed, 23 Oct 2013 05:29:13 GMT

The approach seems fine. For better understanding on updating common peer configuration, you can also refer documentation link(if you need to): http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations.

Re: Where do I edit props.conf in a cluster?

vinit_masaun — Tue, 29 Sep 2020 15:47:17 GMT

I have the same question but for a search head cluster. I have a custom json sourcetype that I need to handle in props.conf on the search head cluster members. I created an app folder under $SPLUNK_HOME/etc/shcluster/apps/ on the deployer server called 'props_conf' under which I created another folder called 'local' where I placed my props.conf and deployed the bundle. However; the settings from the props.conf file are not taking affect. Did I do this right? I have a single server environment as well where I created a local props.conf file under $SPLUNK_HOME/etc/system/local and that works as expected.

Re: Where do I edit props.conf in a cluster?

ddrillic — Sun, 17 Sep 2017 14:38:14 GMT

So, on the search heads, does $SPLUNK_HOME/etc/apps/props_conf/local look fine?

I would check $SPLUNK_HOME/bin/splunk btool --app=props_conf props list on the search head and compare it with the single server's outout of the same command.