topic Re: Where does props.conf need to exist in a distributed deployment? in Getting Data In

Where does props.conf need to exist in a distributed deployment?

pfabrizi — Tue, 29 Sep 2020 15:44:40 GMT

I think I need to push this from the deployment to each device or at least the forwarder and search head.

I have 5 servers making up my SPLUNK Enterprise deployment, 1 SH, 1 FW, 1 DS, 2 Indexers.

My props.conf on the forwarder has this configuration for 1 data source:
FIELDALIAS-severity_as_id = severity as severity_id
FIELDALIAS-dst_as_dest = dst as dest
EVAL-app = netwitness
EXTRACT-subject = CEF:\s+\d(?:|[^|]+){3}|(?[^|]+)

When I search I am not seeing the 'subject' does this need to be pushed to the search head? how about the other devices. I am trying to understand this.

Thanks!

Re: Where does props.conf need to exist in a distributed deployment?

somesoni2 — Wed, 13 Sep 2017 15:44:06 GMT

All the configuration in props.conf you have is "Search time field extraction" related configurations so they should be deployed to your search head (only), not in forwarder. A restart of search head instance will be required if you push the configuration manually (or need to ensure that instance gets restarted if using DS).

Re: Where does props.conf need to exist in a distributed deployment?

pfabrizi — Wed, 13 Sep 2017 16:00:44 GMT

Thank You!