Trying to get a Windows environment moved into a Linux environment, and having problems finding where props.conf is applied to the data. There's no props.conf in local on the search heads, the cluster head or the indexers. Nor are there props.conf in the apps directory of those servers. The search heads are pooled, so I checked the following location:
c:\dfsroot\SearchHeadPooling\etc\apps\search\local\props.conf, but it only has field extractions created inside splunk.
There's no app on the deployment server that includes a props.conf.
Where the deuce are these properties being applied?
Try getting the information with btool.
./splunk btool props list --debug
This should list all your properties and respective files. Please note, props are applied either at index or search time.
Consolidated information about the props are available in wiki http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
Yes thank you! Found out that I didn't have any custom props in this environment period. These people are weird.