topic Re: Does a universal forwarder ever read props.conf? in Getting Data In

Does a universal forwarder ever read props.conf?

a212830 — Sat, 30 Aug 2014 22:40:13 GMT

Hi,

Does a UFW ever read a props.conf file? Is there any reason to put a props.conf on a UFW system?

Re: Does a universal forwarder ever read props.conf?

gkanapathy — Sun, 31 Aug 2014 01:14:06 GMT

Yes it does. See http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F under "inputs".

Re: Does a universal forwarder ever read props.conf?

Runals — Tue, 02 Sep 2014 09:52:37 GMT

? That is not how I understand the process to happen or even what I read from what you linked. A UF has no concept of what an event is. However you can set things like the host and sourcetype fields and what index data goes to. You can't do things like control linebreaking, timestamp definition, etc which are set in props.

Re: Does a universal forwarder ever read props.conf?

cphair — Thu, 07 May 2015 13:41:52 GMT

See http://wiki.splunk.com/Community:HowIndexingWorks for a summary of which settings take effect at which locations.

Re: Does a universal forwarder ever read props.conf?

gbronner_rbc — Tue, 29 Sep 2020 07:24:56 GMT

It appears that you need to edit the props.conf file on the forwarder if you want to have non-default handling of structured (e.g. CSV files).

In particular, I was trying to have a CSV file override the timestamp field to read it from one of my fields -- I needed to tell the fowarder that it was a custom type:

Forwarder:

[myType]
INDEXED_EXTRACTIONS = csv

And on the indexer:

[myType]
INDEXED_EXTRACTIONS = csv
TIMESTAMP_FIELDS = foo

If only the second one was set, the events did not parse correctly.