What will happen to already indexed data if we add props.conf?

[splunkreal]

Hello,

I would like to know the effects of adding props.conf, in order to get relevant fields automatically?

How this will affect the view of already indexed data? Will we then see the new relevant fields only to new indexed data?

Thanks.

[pradeepkumarg]

Fields are usually search time extractions and will work fine on the already indexed data.

Indexed time extractions like Time Stamping, Line Breaking will not have any impact on the already indexed data, but will impact the new incoming data.

[sundareshr]

It depends on the type of settings you add to your props. If it is on the searchhead, they all data will be affected. If it is indextime settings, only new data will be affected. Here a good explanation of settings by phase

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

[splunkreal]

Hello, thanks for your quick responses.

So props.conf only needs to be deployed on search head apps / cluster?