Help for basic questions concerning props.conf and transforms.conf in forwarder and indexer

[jip31]

Hello

I develop a Splunk apps on a DEV platform

In this apps, I am doing field extractions and log file parsing.

As a consequence,  props.conf and transforms.conf files are regularly modified. 

If I want that my Splunk apps works fine in Production, do I have also to update props.conf and transforms.conf in my forwarder? Or on my indexer? Or both in forwarder and indexer ?

Thanks a lot

[richgalloway · Accepted solution]

It depends.  For search-time props the settings must be installed on a search head.  Other settings go on the indexer.  If the forwarder is a heavy forwarder then the same settings go there as well.  Some settings, such as EVENT_BREAKER, go on universal forwarders.

See https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for more information.