topic Re: Is it possible to edit props.conf from Splunk Web? in Getting Data In

Is it possible to edit props.conf from Splunk Web?

gauravmishra15 — Tue, 29 Sep 2020 08:47:05 GMT

Hi Friends,

I've added a custom application in SPLUNK which utilizes LINE_BREAKER and SHOULD_LINEMERGE features of props.conf. The implementation works great in my development instance of SPLUNK.

I have to create this application and add line merge logic on a Splunk Cloud instance. I need your help to understand:

Does SPLUNK offer a way to update application specific props.conf file (from Splunk Web) so that I can apply LINE_BREAKER and LINEMERGE logic? If yes, Please help me with the procedure or how can I achieve this if creating a file in Filesystem and editing is the only option.

Re: Is it possible to edit props.conf from Splunk Web?

skoelpin — Wed, 10 Feb 2016 16:04:17 GMT

I'm pretty sure you CANNOT modify your props.conf from the UI. You will need to edit the .conf file on the indexer

Re: Is it possible to edit props.conf from Splunk Web?

amiracle — Mon, 26 Sep 2016 18:43:28 GMT

Check out this post, it shows how you can use the Web UI to modify the props.conf :
https://answers.splunk.com/answers/149597/im-struggling-with-how-i-should-be-doing-inputs-and-also-props-transforms-etc-stuff-within-splunk-cloud.html

I hope that helps!

-Kam

Re: Is it possible to edit props.conf from Splunk Web?

ichard — Wed, 05 Apr 2017 13:37:02 GMT

That link seems to have gone dead.

Re: Is it possible to edit props.conf from Splunk Web?

tuomassalo — Wed, 17 May 2017 20:02:28 GMT

The link just has one extra plus sign in the end. Can't seem to add a link here, but copy+paste this: https://answers.splunk.com/answers/149597/im-struggling-with-how-i-should-be-doing-inputs-and-also-props-transforms-etc-stuff-within-splunk-cloud.html

Re: Is it possible to edit props.conf from Splunk Web?

MuS — Wed, 17 May 2017 22:36:44 GMT

Hi gauravmishra15,

a bit late for the party ...
In Splunk Enterprise under Settings - Source Types you can list, create and edit sourcetypes options in the according props.conf.

The docs talk about the process to modify sourcetypes in Splunk Enterprise here http://docs.splunk.com/Documentation/Splunk/latest/Data/Managesourcetypes and for Splunk Cloud here http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Managesourcetypes

Hope this helps ...

cheers, MuS