topic Moving a search head pooling Windows environment to a Linux environment, where are my props.conf applied on these servers? in Getting Data In

Moving a search head pooling Windows environment to a Linux environment, where are my props.conf applied on these servers?

banderson7 — Thu, 03 Dec 2015 19:50:29 GMT

Trying to get a Windows environment moved into a Linux environment, and having problems finding where props.conf is applied to the data. There's no props.conf in local on the search heads, the cluster head or the indexers. Nor are there props.conf in the apps directory of those servers. The search heads are pooled, so I checked the following location: c:\dfsroot\SearchHeadPooling\etc\apps\search\local\props.conf, but it only has field extractions created inside splunk.
There's no app on the deployment server that includes a props.conf.
Where the deuce are these properties being applied?

Re: Moving a search head pooling Windows environment to a Linux environment, where are my props.conf applied on these servers?

renjith_nair — Fri, 04 Dec 2015 02:42:18 GMT

Try getting the information with btool.

./splunk btool props list --debug

This should list all your properties and respective files. Please note, props are applied either at index or search time.

Consolidated information about the props are available in wiki http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

Re: Moving a search head pooling Windows environment to a Linux environment, where are my props.conf applied on these servers?

renjith_nair — Wed, 09 Dec 2015 03:58:40 GMT

Does it help?

Re: Moving a search head pooling Windows environment to a Linux environment, where are my props.conf applied on these servers?

banderson7 — Wed, 09 Dec 2015 14:02:22 GMT

Yes thank you! Found out that I didn't have any custom props in this environment period. These people are weird.