What is the difference between putting configuration files under the Splunk Search app and other apps?

[ankithreddy777]

May I know the difference between putting configuration files under search-app or any other newly created app/slave-apps in indexers? If we put config files (indexes.conf and props.conf) under search-apps, can we access the index data through other apps?

[gcusello · Accepted solution]

Hi ankithreddy777,
access to indexes is related to users roles not to the App in which is inserted the indexes.conf file, so you could configure all conf files in search App, and use them in other Apps.
Every way I suggest to you to insert conf files in the related App for many reason:

• at first your work order: it's important to clearly identify for every intervene on configurations working in only one App (I usually avoid also to use global objects!);
• it's important if you need to copy an app in another system (so you can copy only one directory and not a directory + part of some files!);
• it's useful to maintain Apps: when you create a field or an alias .. all these objects are usually related to sourcetype that usually in defined in props.conf, if you put sourcetype in the search App you have part of your props.conf file in an App (Search) and part of it in another one, and risk to be wrong;
• maybe you could have only one indexes.conf file, but I don't like. I hope to have been clear. Bye. Giuseppe