we have splunk main and four splunk universal forwarders.I do not have access to physical box of splunk main which was maintained by some other admins from different group .everytime I have to request the folks to copy the transforms and props files to right folder on splunk main server (/splunk\etc\apps\appnamePOC\local).
can I place these files on my splunkuniversalforwarder machines rather asking admin to copy on splunk main folders
All I need is palce the files to splunkforwarder\etc\apps\appnamePOC\local. will that work?
This will not work. The universal forwarder does not parse data and your props/transforms will be ignored, as they happen where data is parsed. This happens at 1) a heavy forwarder, or 2) an indexer.
So how would you tell the indexer to only apply a props/transforms to a particular monitor on a particular universal forwarder?
Props.conf (and subsequently) applies to a particular sourcetype( or source/host). You have ensure that universal forwarder ->inputs.conf have correct sourcetype (or any other) assignment.
Indexedextractions must be done on the universal forwarder. This answer is for folks using indexedextractions only. If you're struggling getting your props to work, you might consider placing it on the UF now.
Data pipeline phase --- Components that can perform this role
Input --- indexer , universal forwarder , heavy forwarder
Parsing ---- indexer, heavy forwarder, light/universal forwarder (in conjunction with the INDEXED_EXTRACTIONS attribute only)
Search ---indexer,search head