Can props.conf and transforms.conf be created in the Deployment Server GUI to push to indexers?

[lmjoin]

Do props.conf and transforms.conf need to be created in $SPLUNK_HOME/etc/deployment-apps/YOURAPP/local or can it be created in the deployment server GUI to push to indexers?

[MuS]

Hi lmjoin,

The answer here would be a it depends 😉

To a certain extend you can use the Splunk UI to create props and transforms, BUT those files will most likely be located in $SPLUNK_HOME/etc/apps/<appnamehere>/local/.

So, you will have to copy/move them into $SPLUNK_HOME/etc/deployment-apps/ to make them available for the deployment server.

Personally I just create them directly in $SPLUNK_HOME/etc/deployment-apps/<appnamehere>/local/.

Hope this helps ...

cheers, MuS