Getting Data In

Help for basic questions concerning props.conf and transforms.conf in forwarder and indexer

jip31
Motivator

Hello

I develop a Splunk apps on a DEV platform

In this apps, I am doing field extractions and log file parsing.

As a consequence,  props.conf and transforms.conf files are regularly modified. 

If I want that my Splunk apps works fine in Production, do I have also to update props.conf and transforms.conf in my forwarder? Or on my indexer? Or both in forwarder and indexer ?

Thanks a lot

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It depends.  For search-time props the settings must be installed on a search head.  Other settings go on the indexer.  If the forwarder is a heavy forwarder then the same settings go there as well.  Some settings, such as EVENT_BREAKER, go on universal forwarders.

See https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for more information.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It depends.  For search-time props the settings must be installed on a search head.  Other settings go on the indexer.  If the forwarder is a heavy forwarder then the same settings go there as well.  Some settings, such as EVENT_BREAKER, go on universal forwarders.

See https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for more information.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...