Getting Data In

Moving a search head pooling Windows environment to a Linux environment, where are my props.conf applied on these servers?

banderson7
Communicator

Trying to get a Windows environment moved into a Linux environment, and having problems finding where props.conf is applied to the data. There's no props.conf in local on the search heads, the cluster head or the indexers. Nor are there props.conf in the apps directory of those servers. The search heads are pooled, so I checked the following location: c:\dfsroot\SearchHeadPooling\etc\apps\search\local\props.conf, but it only has field extractions created inside splunk.
There's no app on the deployment server that includes a props.conf.
Where the deuce are these properties being applied?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try getting the information with btool.

./splunk btool props list --debug

This should list all your properties and respective files. Please note, props are applied either at index or search time.

Consolidated information about the props are available in wiki http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Try getting the information with btool.

./splunk btool props list --debug

This should list all your properties and respective files. Please note, props are applied either at index or search time.

Consolidated information about the props are available in wiki http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

Happy Splunking!

renjith_nair
SplunkTrust
SplunkTrust

Does it help?

Happy Splunking!
0 Karma

banderson7
Communicator

Yes thank you! Found out that I didn't have any custom props in this environment period. These people are weird.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...