Getting Data In

Placing props.conf in monitoring app



We always place props.conf in parsing app.

Today I saw a config where - props.conf is placed inside monitoring app.

The architecture here is UF --> HF --> Indexer

In all the cases props.conf is placed under parsing app, why only in one case it is placed under monitoring app?

Labels (1)
0 Karma


It depends on the content of props.conf and what you call a "parsing app" compared to a "monitoring app".

Some properties, like EVENT_BREAKER, need to be on a UF so that props.conf file will be in the app deployed there.  Other properties need to be on indexers/HFs or on SHs and so will be in apps deployed in those locations.

If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!