If I have a forwarder, a light forwarder, an indexer, and a search head, where do I need to make my configuration, particular those in props.conf and inputs.conf? Can each setting be done anywhere, or only some places? Does it make a difference where it is set? What happens if the settings are different in each place?
Are the answers to the above questions different for each setting, and if so, is there a listing of these answers anywhere?
I will be offering a bounty on this question. Winning the bounty will require a comprehensive and reasonably easy to read table or chart documenting substantially all
props.conf properties and keys, any significant related ones from other places (such as transforms.conf, outputs.conf). It should indicate where and how the property must be set, where/how it may be set, and what takes precedence in case of conflicts. The properties documented should include:
More detailed and extensive answer here: http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F
Inputs.conf changes need to be made on the forwarder Props.conf (and corresponding references in transforms.conf) changes need to be made on the indexer
Inputs.conf changes need to be made on the forwarder Props.conf (and corresponding references in transforms.conf) changes need to be made on the forwarder
Inputs.conf changes need to be made on the indexer Props.conf is needed for index time extractions
Inputs.conf is not necessarily needed, you only need to deal with it if you want to collect data on this instance Props.conf is needed for all your search time extractions (field extractions being the obvious the example)
The spec file for the conf in question can usually clue in to where the settings need to be made