Getting Data In

Generating props.conf and transforms.conf from Splunk web

Wayoutwilly
New Member

Hi all

Since I'm quite new at this, I was wondering is it possible (on Windows) to generate props.conf and transforms.conf from Splunk Web (or to just slap some command from the command line)? I've set up my input data, line breakers, time formats, defined fields and all that jazz, but I would like to have before mentioned files generated in my etc/system/local directory.
Is that possible in any way or do I have to write them by hand? Because, I really, really don't want to write them by hand...

Thank you in advance

0 Karma
1 Solution

ddrillic
Ultra Champion

The Add Data interface allows us to do that. The following walks us through the process - Upload data

View solution in original post

0 Karma

ddrillic
Ultra Champion

The Add Data interface allows us to do that. The following walks us through the process - Upload data

0 Karma

Wayoutwilly
New Member

Thanks for the reply.
But - I did input my data through Add data process, and I entered my values in the advanced section. The data is in Splunk (just one static log so I didn't monitor it, just uploaded), and when I go to my Source Types, and I open my custom made source (it was made under Category - Custom and App - Search & Reporting), I can see under advanced my BREAK_ONLY_BEFORE, TIME_FORMAT, TIME_PREFIX and other values. But I still don't have props.conf in my etc/system/local folder. There is inputs.conf, migration.conf, README and server.conf.

And now that I've typed all that, I went under "Distribute source type configurations in Splunk Enterprise" and found this line:
For example, if you selected the "Search and Reporting" app, the file resides in $SPLUNK_HOME/etc/apps/search/local/props.conf

This explains everything, the App you save stuff in determines where the file goes... Thanks again for the quick response.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...