Transforms and props files on splunk universal forwarder?

[splunkatl]

we have splunk main and four splunk universal forwarders.I do not have access to physical box of splunk main which was maintained by some other admins from different group .everytime I have to request the folks to copy the transforms and props files to right folder on splunk main server (/splunk\etc\apps\appnamePOC\local).
can I place these files on my splunkuniversalforwarder machines rather asking admin to copy on splunk main folders
All I need is palce the files to splunkforwarder\etc\apps\appnamePOC\local. will that work?

[jkat54]

Indexed_extractions must be done on the universal forwarder. This answer is for folks using indexed_extractions only. If you're struggling getting your props to work, you might consider placing it on the UF now.

http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Configurationparametersandthedatapipeline

Data pipeline phase --- Components that can perform this role
Input --- indexer , universal forwarder , heavy forwarder
Parsing ---- indexer, heavy forwarder, light/universal forwarder (in conjunction with the INDEXED_EXTRACTIONS attribute only)
Indexing ---indexer
Search ---indexer,search head

[jbsplunk · Accepted solution]

This will not work. The universal forwarder does not parse data and your props/transforms will be ignored, as they happen where data is parsed. This happens at 1) a heavy forwarder, or 2) an indexer.

[somesoni2]

Props.conf (and subsequently) applies to a particular sourcetype( or source/host). You have ensure that universal forwarder ->inputs.conf have correct sourcetype (or any other) assignment.

[Strunk]

So how would you tell the indexer to only apply a props/transforms to a particular monitor on a particular universal forwarder?

[jbsplunk]

Glad to be able to help clear things up for you.

[splunkatl]

Thank you for quick response.