- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Props and Transforms doubt
I am new to Splunk admin and please explain this following stanzas:
We have a dedicated syslog server which receives the logs from network devices and UF installed on the server forwards the data to our cluster manager. These configs are in cluster manager under manager apps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @sainag_splunk ..
Then what about inputs.conf and outputs.conf (i believe it will not be there considering it's indexer) in indexer cluster should be configured?
We have deployment server as well. Can you please let me know where it will be there in picture?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

- Data Flow:
Data goes DIRECTLY from UF to indexers on port 9997 (not to cluster manager)
Cluster Manager only handles configuration distribution
- Configuration Management:
Props and transforms configs are deployed via cluster manager
These configs are pushed to index peers via index cluster bundle
- Processing Location:
All parsing happens on the indexers (index peers)
Each indexer applies the deployed configurations independently
For Deep Understanding: Refer: https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platfor...
- Review props.conf documentation: docs.splunk.com/Documentation/Splunk/9.1.0/Admin/Propsconf
- docs.splunk.com/Documentation/ITSI/4.17.0/Configure/transforms.conf
Since there are many pipeline components, I encourage you to read through these resources for a complete understanding.
Simple Data Flow here.
If this Helps, Please Upvote.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @sainag_splunk ,
Also please explain what is index peers you mean and index cluster bundle?
Please reply
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

@Karthikeya Index peers are simply indexers that work together in a Splunk cluster environment. They are responsible for receiving, processing, and storing data while maintaining copies across multiple indexers for redundancy and high availability. When a Cluster Master pushes configuration changes through an index cluster bundle, all index peers receive the same settings to ensure consistent operation across the cluster.
Refer: https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Basicclusterarchitecture
https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Howclusteredindexingworks
If this Helps, Please Upvote and Mark as solved.
