Getting Data In
Highlighted

Transforms and props files on splunk universal forwarder?

Path Finder

we have splunk main and four splunk universal forwarders.I do not have access to physical box of splunk main which was maintained by some other admins from different group .everytime I have to request the folks to copy the transforms and props files to right folder on splunk main server (/splunk\etc\apps\appnamePOC\local).
can I place these files on my splunkuniversalforwarder machines rather asking admin to copy on splunk main folders
All I need is palce the files to splunkforwarder\etc\apps\appnamePOC\local. will that work?

Tags (2)
Highlighted

Re: Transforms and props files on splunk universal forwarder?

Splunk Employee
Splunk Employee

This will not work. The universal forwarder does not parse data and your props/transforms will be ignored, as they happen where data is parsed. This happens at 1) a heavy forwarder, or 2) an indexer.

View solution in original post

Highlighted

Re: Transforms and props files on splunk universal forwarder?

Path Finder

Thank you for quick response.

0 Karma
Highlighted

Re: Transforms and props files on splunk universal forwarder?

Splunk Employee
Splunk Employee

Glad to be able to help clear things up for you.

0 Karma
Highlighted

Re: Transforms and props files on splunk universal forwarder?

Explorer

So how would you tell the indexer to only apply a props/transforms to a particular monitor on a particular universal forwarder?

0 Karma
Highlighted

Re: Transforms and props files on splunk universal forwarder?

SplunkTrust
SplunkTrust

Props.conf (and subsequently) applies to a particular sourcetype( or source/host). You have ensure that universal forwarder ->inputs.conf have correct sourcetype (or any other) assignment.

0 Karma
Highlighted

Re: Transforms and props files on splunk universal forwarder?

SplunkTrust
SplunkTrust

Indexedextractions must be done on the universal forwarder. This answer is for folks using indexedextractions only. If you're struggling getting your props to work, you might consider placing it on the UF now.

http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Configurationparametersandthedatapipeline

Data pipeline phase --- Components that can perform this role
Input --- indexer , universal forwarder , heavy forwarder
Parsing ---- indexer, heavy forwarder, light/universal forwarder (in conjunction with the INDEXED_EXTRACTIONS attribute only)
Indexing ---indexer
Search ---indexer,search head