Where do I edit props.conf in a cluster?

[stevennoble]

If I'm using an index time props.conf setting (in this case SEDCMD) do I edit props.conf on the master or do I have to edit all of the indexers?

[vinit_masaun]

I have the same question but for a search head cluster. I have a custom json sourcetype that I need to handle in props.conf on the search head cluster members. I created an app folder under $SPLUNK_HOME/etc/shcluster/apps/ on the deployer server called 'props_conf' under which I created another folder called 'local' where I placed my props.conf and deployed the bundle. However; the settings from the props.conf file are not taking affect. Did I do this right? I have a single server environment as well where I created a local props.conf file under $SPLUNK_HOME/etc/system/local and that works as expected.

[ddrillic]

So, on the search heads, does $SPLUNK_HOME/etc/apps/props_conf/local look fine?

I would check $SPLUNK_HOME/bin/splunk btool --app=props_conf props list on the search head and compare it with the single server's outout of the same command.

[jkerai · Accepted solution]

You can edit props.conf in $SPLUNK_HOME/etc/master-apps/_cluster/local/props.conf on master and push cluster-bundle with command 'splunk apply cluster-bundle'. Peers will restart and props.conf, in $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf, will be layered when splunkd start.

[dishasaxena]

The approach seems fine. For better understanding on updating common peer configuration, you can also refer documentation link(if you need to): http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations.