Push configuration files in cluster

[shangshin]

Hi,
I have a splunk cluster and have config file props.conf and transforms.conf under master node $SPLUNK_HOME/etc/master-apps/_cluster/local/

I apply the change to its peers using CLI command apply cluster-bundle and I can see the new sourcetype is available on its peers. However, the fields in transforms.conf are not effective.

To veryify this transforms.conf is valid, I manually copy both config files to each peer /etc/system/local/ and it's working as expected.

Can any one shed some light on why transforms.conf is not working when pushed from the master node?

Thanks in advance!

[gkanapathy · Accepted solution]

Search-time fields should not be on indexers, only on the search head. Are your fields search-time extractions?

[gkanapathy]

you should not need to put search-time extractions in the indexers into the indexer configuration. they are ignored. just put them on the search head. splunk will take care of it.

[shangshin]

Agree. If I place the transforms.conf in the search head, then I can see these fields from the search head. So if I want to see these fields on indexer, the only way is to place both config under /etc/system/local/ and it must be bundled with props.conf; otherwise, the fields won't be displayed on the UI. Is that correct?

[shangshin]

Yes, I removed props.conf and transforms.conf from /etc/system/local/ but transforms.conf under /etc/slave-apps/_cluster/local/ still doesn't take any effect....

[ssankeneni]

trying removing the files from /etc/system/local and push the files only from the master node. It might have conflict with the files in /etc/system/local