topic Do you have to use the props.conf method or GUI for a field extraction in a clustered environment? in Splunk Search

Do you have to use the props.conf method or GUI for a field extraction in a clustered environment?

joe06031990 — Tue, 21 Feb 2023 20:53:13 GMT

Hi,

For field extractions in a clustered environment do you have to use the props.conf method or can you use the field extractor GUI on the search head?

Thanks,

Joe

Re: Do you have to use the props.conf method or GUI for a field extraction in a clustered environment?

richgalloway — Tue, 21 Feb 2023 20:56:24 GMT

You can use either method. The GUI will write changes to props.conf in the app's local directory, which the cluster will replicate to other members automatically.