All Apps and Add-ons

inputs.conf in one application and props.conf in other application? Will both synch

splunker12er
Motivator

Just wanted to know , that if i place the inputs.conf in one application and its corresponding props.conf in some other application where it may contain props of that native application also.

Will this work ?

I know that Splunk searches for the props.conf in App->local folder in first prioirty later in App->default folder and when no setting found it searches for configs in System->Local & later System->default

How does Splunk know the location when it is in some other location and prioritize ?

Which config files takes care all of this tasks?

0 Karma

lmyrefelt
Builder

"It will work" since you reference your sourcetype OR source in props.conf for whatever data you want to do something with.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Splunk will load inputs.conf and indextime sourcetype definitions from props.conf from all apps. In case of overwriting configurations, see http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Wheretofindtheconfigurationfiles#Precedence_... for the precedence order.

Note, searchtime props.conf settings such as an EXTRACT-foo value will only be loaded according to the user/app context when searching, unless defined as global.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...