Getting Data In

Generating props.conf and transforms.conf from Splunk web

Wayoutwilly
New Member

Hi all

Since I'm quite new at this, I was wondering is it possible (on Windows) to generate props.conf and transforms.conf from Splunk Web (or to just slap some command from the command line)? I've set up my input data, line breakers, time formats, defined fields and all that jazz, but I would like to have before mentioned files generated in my etc/system/local directory.
Is that possible in any way or do I have to write them by hand? Because, I really, really don't want to write them by hand...

Thank you in advance

0 Karma
1 Solution

ddrillic
Ultra Champion

The Add Data interface allows us to do that. The following walks us through the process - Upload data

View solution in original post

0 Karma

ddrillic
Ultra Champion

The Add Data interface allows us to do that. The following walks us through the process - Upload data

0 Karma

Wayoutwilly
New Member

Thanks for the reply.
But - I did input my data through Add data process, and I entered my values in the advanced section. The data is in Splunk (just one static log so I didn't monitor it, just uploaded), and when I go to my Source Types, and I open my custom made source (it was made under Category - Custom and App - Search & Reporting), I can see under advanced my BREAK_ONLY_BEFORE, TIME_FORMAT, TIME_PREFIX and other values. But I still don't have props.conf in my etc/system/local folder. There is inputs.conf, migration.conf, README and server.conf.

And now that I've typed all that, I went under "Distribute source type configurations in Splunk Enterprise" and found this line:
For example, if you selected the "Search and Reporting" app, the file resides in $SPLUNK_HOME/etc/apps/search/local/props.conf

This explains everything, the App you save stuff in determines where the file goes... Thanks again for the quick response.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...