When the Linux Auditd app is installed on a Splunk Enterprise (indexer), is the props.conf in the TA_linux-auditd/default/props.conf overriding anything by default? I am confused on how overriding works.
Splunk documentations says the following:
Note: If you forward data, and you want to assign a source type for a source, you must assign the source type in props.conf on the forwarder. If you do it in props.conf on the receiver, the override has no effect.
So if I have the Linux Auditd app installed on an indexer and I have a universal forwarder sending audit log data to my indexer, will any configuration I add in TA_linux-auditd/local be applied to data received from forwarders or data that my indexer itself is forwarding??
The NOTE above makes it sound like I need to install Linux Auditd app on my forwarder not just my indexer.
The documentation is wrong. You should assign the sourcetype
in inputs.conf
on the forwarder (NOT in props.conf
). Then don't bother overriding it at all.
First of all overriding works as per the files presedence order. In your case it will be index file precedence order.
1. Slave-app local directories (cluster peers only) -- highest priority
2. System local directory
3. App local directories
4. Slave-app default directories (cluster peers only)
5. App default directories
6. System default directory -- lowest priority
Hope this answers, if not then please rephrase ur question