I need to update the file with this:
with the following content which will configure messages received from the OCP source to split messages correctly:
[source::OCP]
SHOULD_LINEMERGE = false
thanks for answering...when I ran the command, I got the following output:
/Applications/Splunk/bin/splunkd
/Applications/Splunk/etc/apps/framework/server/splunkdj/app_templates/basic/splunkd
/Applications/Splunk/etc/apps/framework/server/apps/quickstartfx/splunkd
/Applications/Splunk/etc/apps/framework/server/apps/homefx/splunkd
/Applications/Splunk/etc/apps/splunk_instrumentation/bin/splunk_instrumentation/splunkd
so there is no search directory at all
@irazabal : So basically you are almost there .-- > /Applications/Splunk/bin/splunkd
Now go to ::
cd /Applications/Splunk/bin/splunk
./splunk status
./splunk restart
Will give you :./splunk status
splunkd is running (PID: 20062).
splunk helpers are running (PIDs: 20063 20065 20070 20119).
go to the /Applications/Splunk/etc/apps/search/local/props.conf
you should find it there
Thanks
Hi @ irazabal123
find / -name splunkd
run this command & go through the list, you will find the installation loaction of splunk on your mac.
& the correction of location in given question, location should be
splunk/etc/apps/search/local/props.conf
if you dont have the file props.conf in local, create the file and add the required stanza to it.
Thanks
You already provided the path in your question. Does that path not exist on your mac? Depending on where you installed splunk, it may or may not be in /opt
Search for /applications/splunk/apps/search/local/props.conf ?