https://community.splunk.com/t5/Splunk-Search/What-is-a-good-convention-for-config-file-organisation/m-p/472894#M192344 <P>Something to ponder while working from home... </P> <P>I am planning on storing and managing my config files in Git. We recently ran into a few confusions managing our props files where our support teams got confused about the same props file (containing extracts and line breaking) getting deployed on search heads and on indexers. </P> <P>So I thought I would come up with a convention that aligns to splunks phases. As per below... </P> <PRE><CODE>&lt;company&gt;_search_&lt;app&gt; search app for user dashboards and reports (not to be held in git at present) &lt;company&gt;_data_&lt;app&gt; (field extractsion, calculated fields) &lt;company&gt;_parse_&lt;app&gt; (props and transforms for line breaking, timestamping etc) &lt;deployment&gt;_&lt;p|t&gt;_&lt;app&gt;_&lt;sub_component&gt; (inputs, outputs etc) very much environment specific </CODE></PRE> <P>Does anyone else worry about this stuff like I seem to and have a suggestion? </P> <P>Mike</P> Wed, 15 Apr 2020 16:53:10 GMT mikeydee 2020-04-15T16:53:10Z https://community.splunk.com/t5/Splunk-Search/What-is-a-good-convention-for-config-file-organisation/m-p/472894#M192344 <P>Something to ponder while working from home... </P> <P>I am planning on storing and managing my config files in Git. We recently ran into a few confusions managing our props files where our support teams got confused about the same props file (containing extracts and line breaking) getting deployed on search heads and on indexers. </P> <P>So I thought I would come up with a convention that aligns to splunks phases. As per below... </P> <PRE><CODE>&lt;company&gt;_search_&lt;app&gt; search app for user dashboards and reports (not to be held in git at present) &lt;company&gt;_data_&lt;app&gt; (field extractsion, calculated fields) &lt;company&gt;_parse_&lt;app&gt; (props and transforms for line breaking, timestamping etc) &lt;deployment&gt;_&lt;p|t&gt;_&lt;app&gt;_&lt;sub_component&gt; (inputs, outputs etc) very much environment specific </CODE></PRE> <P>Does anyone else worry about this stuff like I seem to and have a suggestion? </P> <P>Mike</P> Wed, 15 Apr 2020 16:53:10 GMT https://community.splunk.com/t5/Splunk-Search/What-is-a-good-convention-for-config-file-organisation/m-p/472894#M192344 mikeydee 2020-04-15T16:53:10Z https://community.splunk.com/t5/Splunk-Search/What-is-a-good-convention-for-config-file-organisation/m-p/472895#M192345 <P>Answering my own question with this earlier one... </P> <P><A href="https://answers.splunk.com/answers/4559/best-practices-for-installing-and-configuring-apps-in-a-distributed-splunk-install.html">https://answers.splunk.com/answers/4559/best-practices-for-installing-and-configuring-apps-in-a-distributed-splunk-install.html</A></P> Thu, 30 Apr 2020 14:19:24 GMT https://community.splunk.com/t5/Splunk-Search/What-is-a-good-convention-for-config-file-organisation/m-p/472895#M192345 mikeydee 2020-04-30T14:19:24Z