topic Re: Universal Forwarder and props.conf and transforms.conf in Getting Data In

Universal Forwarder and props.conf and transforms.conf

phoenixdigital — Fri, 08 Jul 2011 00:03:50 GMT

Just a quick question regarding the "Universal Forwarder"

I have setup my inputs.conf and outputs.conf in
/opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/
this works perfectly

However I also wanted to perform some processing on these inputs prior to sending to the indexer.

It made sense that I would need to add props.conf and transforms.conf to this directory.

This however did not appear to work. Adding the props.conf and transforms.conf files to the indexer worked however.

Is there a way to do this on the universal forwarder or does it need to be done on the indexer?

Re: Universal Forwarder and props.conf and transforms.conf

dwaddle — Fri, 08 Jul 2011 03:42:36 GMT

Universal Forwarder and Light Forwarder do not parse events before passing them on to the indexer. Because they do not, most props.conf and transforms.conf settings need to be done at the indexer. This is what makes these two Forwarders "lighter" than the standard "Heavy" forwarder and a Splunk indexer.

Re: Universal Forwarder and props.conf and transforms.conf

phoenixdigital — Tue, 12 Jul 2011 22:25:24 GMT

Thanks for the information. Makes sense from the perspective of 'light' and 'heavy' system usage.

Re: Universal Forwarder and props.conf and transforms.conf

walterk82 — Thu, 23 Mar 2017 13:21:59 GMT

most props.conf and transforms.conf settings need to be done at the indexer

Is there a more comprehensive definition of "most" and "works"?

Re: Universal Forwarder and props.conf and transforms.conf

walterk82 — Thu, 23 Mar 2017 13:25:30 GMT

Answered my own question:
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

Re: Universal Forwarder and props.conf and transforms.conf

DUThibault — Tue, 06 Feb 2018 20:43:27 GMT

You can have your Universal Forwarder do the index-time work, meaning SEDCMD and TRANSFORMS, as well as sourcetyping. The trick is that the Universal Forwarder's props.conf and transforms.conf must be on the forwarder (if you edit them in /opt/splunk/etc/deployment-apps/_server_app_<forwarder_class>/local/, Splunk will send the files to the forwarders for you) and the props.conf [<sourcetype>] and [source::<source>] stanzas must have a force_local_processing = true clause. Note that if the Universal Forwarder does the indexing, the Splunk instances won't: all of the index-time work must be done on the Universal Forwarder.

Re: Universal Forwarder and props.conf and transforms.conf

irwinj_125 — Fri, 29 Jan 2021 17:05:05 GMT

Apologies for my ignorance. I've having a similar issue.

Regarding this comment:

"This however did not appear to work. Adding the props.conf and transforms.conf files to the indexer worked however."

Exactly how do you add these files to the indexer?