Archive
Highlighted

Editing props.conf & transforms.conf configuration file

Communicator

I found that both props.conf & transforms.conf config files are found the $SPLUNK_HOME/etc/system/default/ directory. I would like to create search time field extraction through those two config files in that location. However, the doc
http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Createandmaintainsearch-timefieldextract...

says Note: Do not edit files in $SPLUNK_HOME/etc/system/default/.

So can i still create search time field extraction through those two config files in $SPLUNK_HOME/etc/system/default/ ????

Tags (1)
Highlighted

Re: Editing props.conf & transforms.conf configuration file

Ultra Champion

Create a props.conf and transforms.conf in $SPLUNK_HOME/etc/system/local and edit them there.

If $SPLUNK_HOME/etc/system/local does not exist, then create the directory.

Highlighted

Re: Editing props.conf & transforms.conf configuration file

Communicator

If i want to create search time field extraction for the SEARCH APP through those two config files in that location then i have to create the props.conf and transform.conf in
this directory :
$SPLUNK_HOME/etc/apps/search/local/

Is it??

0 Karma
Highlighted

Re: Editing props.conf & transforms.conf configuration file

Communicator

The Splunk Doc on the About configuration files says :
"If you want to edit a configuration file such that the change only applies to a certain app, copy the file to the app's /local directory and make your changes there."

How do i know which file i should copy to the app local directory?

0 Karma
Highlighted

Re: Editing props.conf & transforms.conf configuration file

Legend

Well that depends on the change you want to make. If the changes you are making are made in transforms.conf and props.conf, then those are the files you should put there. NOTE that you don't need to copy an existing config file there, just create your own with the config values you want to set. These values will be merged with the configuration values found in other files.

0 Karma
Highlighted

Re: Editing props.conf & transforms.conf configuration file

Communicator

okay.kkkkkkk

0 Karma