Deployment Architecture

Unable to push the config from cluster master

syedabuthahir
Explorer

Hi All,

 

We are trying to push the props and transforms config files from Cluster Master to all indexers. Source types are visible but the rules are not applied from the config files.

Please assist on this issue.

Thanks in Advance.

Labels (1)
0 Karma

codebuilder
Influencer

Are you saying the configs dont get pushed from the master or they are not applied?

Most extractions are done at search time, not index time. For search time extractions, your configs would need to go to the search heads, not the indexers.

https://docs.splunk.com/Documentation/Splunk/8.2.1/Indexer/Indextimeversussearchtime

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

isoutamo
SplunkTrust
SplunkTrust
If you are added new extractions etc. for indexers then those are valid only when new data has indexed not for old already indexed events.
As @codebuilder said for search time props + transforms conf must be on SH side not on Indexer side. Also remember add fields.conf to SH side if/when you have any additional indexed fields.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...