https://community.splunk.com/t5/Getting-Data-In/where-to-add-my-props-conf-for-new-sourcetype-created-using/m-p/366692#M92943 <P>Hello @Skins,<BR /> There are couple questions here, I will try to address one by one<BR /> You will probably want to push inputs.conf to monitor a file and not props.conf,<BR /> this is a great wiki page that explains where conf files go:<BR /> <A href="https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F">https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F</A><BR /> to automate this process across forwarder (and other splunk instances) you can use one of your splunk instances as a Deployment Server. According to your architecture description, your Search Head is the best candidate.<BR /> here is docs on how to configure deployment server and deployment clients (pay attention that Indexers can be clients too!):<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/Updating/Configuredeploymentclients">http://docs.splunk.com/Documentation/Splunk/6.6.0/Updating/Configuredeploymentclients</A><BR /> now you can build small apps that will carry configurations such as inputs, outputs, props and more!<BR /> create serverclasses and assign clients and apps to groups, now you can control your Indexers configuration and forwarders configurations from one single machine.</P> <P>Let us know if it worked well.</P> <P>hope it helps</P> Tue, 09 May 2017 01:09:42 GMT adonio 2017-05-09T01:09:42Z https://community.splunk.com/t5/Getting-Data-In/where-to-add-my-props-conf-for-new-sourcetype-created-using/m-p/366691#M92942 <P>I want to push out a props .conf file to monitor a file which resides on two machines with forwarders deployed.</P> <P>my env consists of 1 x sh , 2 x indexer (not clustered) 2 x ufs</P> <P>So far i have used the manual file upload method to create a new sourcetype and used the preview window to separate and timestamp my events how i want.</P> <P>Now i'm unclear best practice to deploy these to the indexers and where they should reside ? should they also be added to my deployment apps directory and deployed to the forwarders ?</P> <P>gratzi</P> Mon, 08 May 2017 04:03:16 GMT https://community.splunk.com/t5/Getting-Data-In/where-to-add-my-props-conf-for-new-sourcetype-created-using/m-p/366691#M92942 Skins 2017-05-08T04:03:16Z https://community.splunk.com/t5/Getting-Data-In/where-to-add-my-props-conf-for-new-sourcetype-created-using/m-p/366692#M92943 <P>Hello @Skins,<BR /> There are couple questions here, I will try to address one by one<BR /> You will probably want to push inputs.conf to monitor a file and not props.conf,<BR /> this is a great wiki page that explains where conf files go:<BR /> <A href="https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F">https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F</A><BR /> to automate this process across forwarder (and other splunk instances) you can use one of your splunk instances as a Deployment Server. According to your architecture description, your Search Head is the best candidate.<BR /> here is docs on how to configure deployment server and deployment clients (pay attention that Indexers can be clients too!):<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/Updating/Configuredeploymentclients">http://docs.splunk.com/Documentation/Splunk/6.6.0/Updating/Configuredeploymentclients</A><BR /> now you can build small apps that will carry configurations such as inputs, outputs, props and more!<BR /> create serverclasses and assign clients and apps to groups, now you can control your Indexers configuration and forwarders configurations from one single machine.</P> <P>Let us know if it worked well.</P> <P>hope it helps</P> Tue, 09 May 2017 01:09:42 GMT https://community.splunk.com/t5/Getting-Data-In/where-to-add-my-props-conf-for-new-sourcetype-created-using/m-p/366692#M92943 adonio 2017-05-09T01:09:42Z https://community.splunk.com/t5/Getting-Data-In/where-to-add-my-props-conf-for-new-sourcetype-created-using/m-p/366693#M92944 <P>That was an error in my original post - i meant the inputs.conf for the file monitoring.</P> <P>I didnt however think of using the DS to deploy to the indexers as well as the UF's </P> <P>gratzi</P> Tue, 09 May 2017 04:07:19 GMT https://community.splunk.com/t5/Getting-Data-In/where-to-add-my-props-conf-for-new-sourcetype-created-using/m-p/366693#M92944 Skins 2017-05-09T04:07:19Z