Getting Data In

Placing props.conf in monitoring app



We always place props.conf in parsing app.

Today I saw a config where - props.conf is placed inside monitoring app.

The architecture here is UF --> HF --> Indexer

In all the cases props.conf is placed under parsing app, why only in one case it is placed under monitoring app?

Labels (1)
0 Karma


It depends on the content of props.conf and what you call a "parsing app" compared to a "monitoring app".

Some properties, like EVENT_BREAKER, need to be on a UF so that props.conf file will be in the app deployed there.  Other properties need to be on indexers/HFs or on SHs and so will be in apps deployed in those locations.

If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!