Archive

where do I find this file for my mac splunk enterprise 7.1.2: Configure the /opt/splunk/apps/search/local/props.conf file

irazabal123
New Member

I need to update the file with this:
with the following content which will configure messages received from the OCP source to split messages correctly:

[source::OCP]
SHOULD_LINEMERGE = false

Tags (1)
0 Karma

irazabal123
New Member

thanks for answering...when I ran the command, I got the following output:
/Applications/Splunk/bin/splunkd
/Applications/Splunk/etc/apps/framework/server/splunkdj/app_templates/basic/splunkd
/Applications/Splunk/etc/apps/framework/server/apps/quickstartfx/splunkd
/Applications/Splunk/etc/apps/framework/server/apps/homefx/splunkd
/Applications/Splunk/etc/apps/splunk_instrumentation/bin/splunk_instrumentation/splunkd
so there is no search directory at all

0 Karma

Darkmattersalmi
New Member

@irazabal : So basically you are almost there .-- > /Applications/Splunk/bin/splunkd

Now go to ::
cd /Applications/Splunk/bin/splunk
./splunk status
./splunk restart

Will give you :./splunk status

splunkd is running (PID: 20062).
splunk helpers are running (PIDs: 20063 20065 20070 20119).

0 Karma

PowerPacked
Builder

go to the /Applications/Splunk/etc/apps/search/local/props.conf

you should find it there

Thanks

0 Karma

PowerPacked
Builder

Hi @ irazabal123

find / -name splunkd
run this command & go through the list, you will find the installation loaction of splunk on your mac.

& the correction of location in given question, location should be
splunk/etc/apps/search/local/props.conf

if you dont have the file props.conf in local, create the file and add the required stanza to it.

Thanks

0 Karma

pradeepkumarg
Influencer

You already provided the path in your question. Does that path not exist on your mac? Depending on where you installed splunk, it may or may not be in /opt

Search for /applications/splunk/apps/search/local/props.conf ?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!