All Apps and Add-ons

inputs.conf in one application and props.conf in other application? Will both synch

splunker12er
Motivator

Just wanted to know , that if i place the inputs.conf in one application and its corresponding props.conf in some other application where it may contain props of that native application also.

Will this work ?

I know that Splunk searches for the props.conf in App->local folder in first prioirty later in App->default folder and when no setting found it searches for configs in System->Local & later System->default

How does Splunk know the location when it is in some other location and prioritize ?

Which config files takes care all of this tasks?

0 Karma

lmyrefelt
Builder

"It will work" since you reference your sourcetype OR source in props.conf for whatever data you want to do something with.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Splunk will load inputs.conf and indextime sourcetype definitions from props.conf from all apps. In case of overwriting configurations, see http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Wheretofindtheconfigurationfiles#Precedence_... for the precedence order.

Note, searchtime props.conf settings such as an EXTRACT-foo value will only be loaded according to the user/app context when searching, unless defined as global.

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...