topic Re: Setting up props.conf at the heavy forwarders in Getting Data In

Setting up props.conf at the heavy forwarders

vr2312 — Fri, 07 Oct 2016 09:51:36 GMT

I have an app to which the basic inputs.conf were set and the app was forwarding logs to the indexers without any issues.

Then the format of the logs changed due to which i had to write a props.conf.

The regex were tested in the test environment and the same were deployed inside the app.

I now see that the production logs are still not accommodating the props.conf and the logs are still populating without using the line breakers.

Question : Should i be pushing the props.conf to the heavy forwarders too ? If yes, How ?

Re: Setting up props.conf at the heavy forwarders

inventsekar — Fri, 07 Oct 2016 09:55:47 GMT

may i know, if you have restarted splunk on the UF after updating props.conf?,
you must restart Splunk to enable configurations.

Re: Setting up props.conf at the heavy forwarders

vr2312 — Fri, 07 Oct 2016 09:57:51 GMT

Yes. The forwarders were restarted.

Re: Setting up props.conf at the heavy forwarders

gcusello — Fri, 07 Oct 2016 10:00:19 GMT

Hi vr2312,
You have to send props.conf also to the HF.
you can do it creating a dedicated ServerClass to distribute an appropriate TA using your Deployment Server.
Be aware to one issue: if you use your HFs to ingest syslogs with a load balancer, when you restart Splunk on HFs you lose some events because all HFs are restarted at the same time; so, if you haven't many HFs, maybe, it could be better to manually update them one by one.
Bye.
Giuseppe

Re: Setting up props.conf at the heavy forwarders

vr2312 — Fri, 07 Oct 2016 10:50:41 GMT

Thank you. I have forwarded the same. Let me see if the changes gets accommodated now.

Also, thanks for the additional input 🙂

Will keep you posted on the changes.