topic Re: How to edit the configuration files? in Installation

How to edit the configuration files?

bhupinder_singh — Thu, 21 Jun 2012 00:04:44 GMT

I am new to splunk. Could anyone please tell me how should I proceed in editing the .conf files in local directory? Are these changes critical to the parsing of the log files before they are indexed for search? I know that the inputs.conf and sourcetypes.conf has to be changed but I am not getting the required fields as per the log files, even if I do not make any changes at all.

Thanks.

Re: How to edit the configuration files?

sdaniels — Thu, 21 Jun 2012 01:19:58 GMT

The best place to start is here.

http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/GetthesampledataintoSplunk

For the basics of adding data to Splunk this will make changes to the config files for you. For more advanced data there are examples and details in our online documentation as well.

Re: How to edit the configuration files?

yannK — Thu, 21 Jun 2012 03:45:41 GMT

Usually parsing rules and field extraction (index time and search-time) are in props.conf organized per sourcetype

For index time, add it on the indexer, for search-time, on the search-head (if any).

Remarks :

never edit the /default/ always create a new file in /local/ to contains your new settings and modifications.
If you edit a config file, restart the splunk instance to apply.

Re: How to edit the configuration files?

bhupinder_singh — Thu, 21 Jun 2012 20:47:15 GMT

I have read this in a good many places that rather than playing with config files beforehand, it is always better to do it after providing the input and parsing , i.e. - dynamic searching. This may result in addition of fields when we use regex on the log event entries in the index obtained from Splunk.
But making changes with regex for a particular field, then obtaining one of use and then saving it is also not an easy task, especially if you are not good at regex.

Thanks.

Re: How to edit the configuration files?

sdaniels — Thu, 21 Jun 2012 21:52:49 GMT

I would recommend trying the field extractor. That might help you get some of the extractions that aren't discovered automatically.

http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/ExtractfieldsinteractivelywithIFX