Getting Data In

Should props.conf match inputs.conf?

Path Finder

Does the props.conf file of an indexer has the same contents as the inputs.conf file of the forwarder from which it is receiving the data?

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

If by "have the same contents" you mean props.conf is an exact copy of inputs.conf the answer is NO.
The props.conf file on an indexer should have a stanza corresponding to each sourcetype referenced by the forwarder's inputs.conf file.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

If by "have the same contents" you mean props.conf is an exact copy of inputs.conf the answer is NO.
The props.conf file on an indexer should have a stanza corresponding to each sourcetype referenced by the forwarder's inputs.conf file.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Ultra Champion
0 Karma

Path Finder

Thank you very much @richgalloway and @ddrillic.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!