Getting Data In

Setting up props.conf at the heavy forwarders

Contributor

I have an app to which the basic inputs.conf were set and the app was forwarding logs to the indexers without any issues.

Then the format of the logs changed due to which i had to write a props.conf.

The regex were tested in the test environment and the same were deployed inside the app.

I now see that the production logs are still not accommodating the props.conf and the logs are still populating without using the line breakers.

Question : Should i be pushing the props.conf to the heavy forwarders too ? If yes, How ?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi vr2312,
You have to send props.conf also to the HF.
you can do it creating a dedicated ServerClass to distribute an appropriate TA using your Deployment Server.
Be aware to one issue: if you use your HFs to ingest syslogs with a load balancer, when you restart Splunk on HFs you lose some events because all HFs are restarted at the same time; so, if you haven't many HFs, maybe, it could be better to manually update them one by one.
Bye.
Giuseppe

View solution in original post

SplunkTrust
SplunkTrust

Hi vr2312,
You have to send props.conf also to the HF.
you can do it creating a dedicated ServerClass to distribute an appropriate TA using your Deployment Server.
Be aware to one issue: if you use your HFs to ingest syslogs with a load balancer, when you restart Splunk on HFs you lose some events because all HFs are restarted at the same time; so, if you haven't many HFs, maybe, it could be better to manually update them one by one.
Bye.
Giuseppe

View solution in original post

Contributor

Thank you. I have forwarded the same. Let me see if the changes gets accommodated now.

Also, thanks for the additional input 🙂

Will keep you posted on the changes.

0 Karma

Super Champion

may i know, if you have restarted splunk on the UF after updating props.conf?,
you must restart Splunk to enable configurations.

0 Karma

Contributor

Yes. The forwarders were restarted.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!