<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: props.conf issues in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/props-conf-issues/m-p/160506#M32540</link>
    <description>&lt;P&gt;splunk cmd btool props list -debug&lt;/P&gt;</description>
    <pubDate>Fri, 29 Nov 2013 15:10:20 GMT</pubDate>
    <dc:creator>gfuente</dc:creator>
    <dc:date>2013-11-29T15:10:20Z</dc:date>
    <item>
      <title>props.conf issues</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/props-conf-issues/m-p/160505#M32539</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I added some recent feeds, and they were working fine, but then I realized that I had put the props.conf on the universal forwarder, but they belong on the indexer. (This is correct, right?) &lt;/P&gt;

&lt;P&gt;Once I moved my props.confs to the indexer, they stopped working correctly, so obviously, my props.conf has issues.  I seem to recall a command to display the config that is being used splunk for a feed.  Can someone provide that command?  &lt;/P&gt;</description>
      <pubDate>Fri, 29 Nov 2013 14:57:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/props-conf-issues/m-p/160505#M32539</guid>
      <dc:creator>a212830</dc:creator>
      <dc:date>2013-11-29T14:57:56Z</dc:date>
    </item>
    <item>
      <title>Re: props.conf issues</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/props-conf-issues/m-p/160506#M32540</link>
      <description>&lt;P&gt;splunk cmd btool props list -debug&lt;/P&gt;</description>
      <pubDate>Fri, 29 Nov 2013 15:10:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/props-conf-issues/m-p/160506#M32540</guid>
      <dc:creator>gfuente</dc:creator>
      <dc:date>2013-11-29T15:10:20Z</dc:date>
    </item>
  </channel>
</rss>

