You should not change it on the forwarder, but on the Splunk instance where the parsing takes place. This is usually the indexer.
And props.conf can exist in many different places. And they all count, since they're merged together at runtime (when splunk restarts, or re-reads the configs).
The one place where settings will always work is in /opt/splunk/etc/system/local. Open the props.conf there and make your adjustments.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/Propsconf
This is a pretty short answer to what might develop into several follow-up questions. But please - do take the time to read some documentation. Especially on the topics of configuration file precedence, and the splunk data pipeline.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/Wheretofindtheconfigurationfiles
http://docs.splunk.com/Documentation/Splunk/6.1.3/Deploy/Datapipeline
/k
