Getting Data In

Generating props.conf and transforms.conf from Splunk web

Wayoutwilly
New Member

Hi all

Since I'm quite new at this, I was wondering is it possible (on Windows) to generate props.conf and transforms.conf from Splunk Web (or to just slap some command from the command line)? I've set up my input data, line breakers, time formats, defined fields and all that jazz, but I would like to have before mentioned files generated in my etc/system/local directory.
Is that possible in any way or do I have to write them by hand? Because, I really, really don't want to write them by hand...

Thank you in advance

0 Karma
1 Solution

ddrillic
Ultra Champion

The Add Data interface allows us to do that. The following walks us through the process - Upload data

View solution in original post

0 Karma

ddrillic
Ultra Champion

The Add Data interface allows us to do that. The following walks us through the process - Upload data

0 Karma

Wayoutwilly
New Member

Thanks for the reply.
But - I did input my data through Add data process, and I entered my values in the advanced section. The data is in Splunk (just one static log so I didn't monitor it, just uploaded), and when I go to my Source Types, and I open my custom made source (it was made under Category - Custom and App - Search & Reporting), I can see under advanced my BREAK_ONLY_BEFORE, TIME_FORMAT, TIME_PREFIX and other values. But I still don't have props.conf in my etc/system/local folder. There is inputs.conf, migration.conf, README and server.conf.

And now that I've typed all that, I went under "Distribute source type configurations in Splunk Enterprise" and found this line:
For example, if you selected the "Search and Reporting" app, the file resides in $SPLUNK_HOME/etc/apps/search/local/props.conf

This explains everything, the App you save stuff in determines where the file goes... Thanks again for the quick response.

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...