Setting up props.conf at the heavy forwarders

[vr2312]

I have an app to which the basic inputs.conf were set and the app was forwarding logs to the indexers without any issues.

Then the format of the logs changed due to which i had to write a props.conf.

The regex were tested in the test environment and the same were deployed inside the app.

I now see that the production logs are still not accommodating the props.conf and the logs are still populating without using the line breakers.

Question : Should i be pushing the props.conf to the heavy forwarders too ? If yes, How ?

[gcusello · Accepted solution]

Hi vr2312,
You have to send props.conf also to the HF.
you can do it creating a dedicated ServerClass to distribute an appropriate TA using your Deployment Server.
Be aware to one issue: if you use your HFs to ingest syslogs with a load balancer, when you restart Splunk on HFs you lose some events because all HFs are restarted at the same time; so, if you haven't many HFs, maybe, it could be better to manually update them one by one.
Bye.
Giuseppe

[vr2312]

Thank you. I have forwarded the same. Let me see if the changes gets accommodated now.

Also, thanks for the additional input 🙂

Will keep you posted on the changes.

[inventsekar]

may i know, if you have restarted splunk on the UF after updating props.conf?,
you must restart Splunk to enable configurations.

[vr2312]

Yes. The forwarders were restarted.