Split my props.conf for using a forwarder

[timmalos]

Hi.
I must change the way I get inputs into Splunk by using a forwarder.
Until now I was doing something like : (one example between others)

[monitor://\\bob01\LogInput\Vmware4Splunk\datastores\*.txt]
disabled = false
host_regex = ([^\\]*).txt$
sourcetype = Vmware_Datastores
index = Infra_vmware

That works well but I want to use the universal forwarder I configured on \\bob01. So on bob01 inputs.conf I add (one example between others):

[monitor://E:\Data\LogInput\Vmware4Splunk\datastores\*.txt]
disabled = false
host_regex = ([^\\]*).txt$
sourcetype = Vmware_Datastores
index = Infra_vmware

I got a props.conf like this (These are the only properties for indexing):

[host::Stgeorge]
TZ=Atlantic/Bermuda
[host::Freeport]
TZ=America/Nassau
[host::Matterhorn]
TZ=Europe/Paris
[host::Quarry]
TZ=Europe/Paris

[CSWAlias]
SHOULD_LINEMERGE = false
[vspla]
SHOULD_LINEMERGE=false
[vspco]
SHOULD_LINEMERGE=false
[Vmware_Datastores]
MAX_TIMESTAMP_LOOKAHEAD = 30
SHOULD_LINEMERGE=false

My question is: In all these properties (SHOULD_LINEMERGE, TZ and MAX_TIMESTAMP_LOOKAHEAD), which ones I must copy or cut on the forwarder 's props.conf file ? I let them on my splunk indexer too?

[kristian_kolb · Accepted solution]

All of those (SHOULD_LINEMERGE, TZ and MAX_TIMESTAMP_LOOKAHEAD) are usesd during the Parsing Phase, and none of them are understood by the Universal Forwarder, so if that is what you are planning to have, the settings should stay on the indexer. However, if you are planning to use a Heavy Forwarder, you should move those settings there, since a Heavy Forwarder also does the Parsing.

See below link for more info;

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

Hope this helps,

K

[sowings]

Note that you can send all of the props.conf to the forwarder, indexer, search head, but each node will only care about the contents related to its own functionality. I.e., forwarder only cares about things related to setting a sourcetype (if one isn't set on the inputs), indexer cares about line breaking, time parsing, TRANSFORMS, search head cares about REPORT, EVAL, FIELDALIAS, etc.

It's this "selective focus" that prompts us to keep props for a given sourcetype all together, and copy it wholesale to all of the nodes that might need it. Splunk will sort out the contents.

[timmalos]

Perfect, thnks a lot !