Getting Data In

Can props.conf and transforms.conf be created in the Deployment Server GUI to push to indexers?

lmjoin
Explorer

Do props.conf and transforms.conf need to be created in $SPLUNK_HOME/etc/deployment-apps/YOURAPP/local or can it be created in the deployment server GUI to push to indexers?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi lmjoin,

The answer here would be a it depends 😉

To a certain extend you can use the Splunk UI to create props and transforms, BUT those files will most likely be located in $SPLUNK_HOME/etc/apps/<appnamehere>/local/.

So, you will have to copy/move them into $SPLUNK_HOME/etc/deployment-apps/ to make them available for the deployment server.

Personally I just create them directly in $SPLUNK_HOME/etc/deployment-apps/<appnamehere>/local/.

Hope this helps ...

cheers, MuS

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.