Getting Data In

Generating props.conf and transforms.conf from Splunk web

Wayoutwilly
New Member

Hi all

Since I'm quite new at this, I was wondering is it possible (on Windows) to generate props.conf and transforms.conf from Splunk Web (or to just slap some command from the command line)? I've set up my input data, line breakers, time formats, defined fields and all that jazz, but I would like to have before mentioned files generated in my etc/system/local directory.
Is that possible in any way or do I have to write them by hand? Because, I really, really don't want to write them by hand...

Thank you in advance

0 Karma
1 Solution

ddrillic
Ultra Champion

The Add Data interface allows us to do that. The following walks us through the process - Upload data

View solution in original post

0 Karma

ddrillic
Ultra Champion

The Add Data interface allows us to do that. The following walks us through the process - Upload data

0 Karma

Wayoutwilly
New Member

Thanks for the reply.
But - I did input my data through Add data process, and I entered my values in the advanced section. The data is in Splunk (just one static log so I didn't monitor it, just uploaded), and when I go to my Source Types, and I open my custom made source (it was made under Category - Custom and App - Search & Reporting), I can see under advanced my BREAK_ONLY_BEFORE, TIME_FORMAT, TIME_PREFIX and other values. But I still don't have props.conf in my etc/system/local folder. There is inputs.conf, migration.conf, README and server.conf.

And now that I've typed all that, I went under "Distribute source type configurations in Splunk Enterprise" and found this line:
For example, if you selected the "Search and Reporting" app, the file resides in $SPLUNK_HOME/etc/apps/search/local/props.conf

This explains everything, the App you save stuff in determines where the file goes... Thanks again for the quick response.

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...