Getting Data In

Can props.conf and transforms.conf be created in the Deployment Server GUI to push to indexers?

lmjoin
Explorer

Do props.conf and transforms.conf need to be created in $SPLUNK_HOME/etc/deployment-apps/YOURAPP/local or can it be created in the deployment server GUI to push to indexers?

0 Karma

MuS
Legend

Hi lmjoin,

The answer here would be a it depends 😉

To a certain extend you can use the Splunk UI to create props and transforms, BUT those files will most likely be located in $SPLUNK_HOME/etc/apps/<appnamehere>/local/.

So, you will have to copy/move them into $SPLUNK_HOME/etc/deployment-apps/ to make them available for the deployment server.

Personally I just create them directly in $SPLUNK_HOME/etc/deployment-apps/<appnamehere>/local/.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...