Hi all
Since I'm quite new at this, I was wondering is it possible (on Windows) to generate props.conf and transforms.conf from Splunk Web (or to just slap some command from the command line)? I've set up my input data, line breakers, time formats, defined fields and all that jazz, but I would like to have before mentioned files generated in my etc/system/local directory.
Is that possible in any way or do I have to write them by hand? Because, I really, really don't want to write them by hand...
Thank you in advance
The Add Data interface allows us to do that. The following walks us through the process - Upload data
The Add Data interface allows us to do that. The following walks us through the process - Upload data
Thanks for the reply.
But - I did input my data through Add data process, and I entered my values in the advanced section. The data is in Splunk (just one static log so I didn't monitor it, just uploaded), and when I go to my Source Types, and I open my custom made source (it was made under Category - Custom and App - Search & Reporting), I can see under advanced my BREAK_ONLY_BEFORE, TIME_FORMAT, TIME_PREFIX and other values. But I still don't have props.conf in my etc/system/local folder. There is inputs.conf, migration.conf, README and server.conf.
And now that I've typed all that, I went under "Distribute source type configurations in Splunk Enterprise" and found this line:
For example, if you selected the "Search and Reporting" app, the file resides in $SPLUNK_HOME/etc/apps/search/local/props.conf
This explains everything, the App you save stuff in determines where the file goes... Thanks again for the quick response.