Where do I put props.conf and transforms.conf stanzas to parse custom IIS and firewall fields? Will this impact previously indexed data?

[aferone]

I am trying to parse custom IIS and Windows Firewall fields using props and transforms.

Our Universal Forwarders first send logs to Heavy Forwarders, then to the Indexers.

Where is the proper place to put the props and transforms so that the fields are parsed correctly?

Also, will this affect data already indexed, or just new data?

Thanks. This has always been confusing to me, so thanks for helping!

[richgalloway]

Any change to a config file only affects new data. There is no way to change already-indexed data.

Are you sure you need the heavy forwarders? If not set up carefully, they can cause performance problems.

As for where to put the props and transforms, the answer is 'it depends'. What will be done to the data determines where it is done, but you can usually get away with putting everything on the indexers.

[aferone]

Well, "no way to change already-indexed data" is not entirely accurate.

I had an extra hyphen in the title of my props and transforms settings, so that was the issue. Once I fixed it, the fields were parsing as I had intended.

Thanks for answering!

[richgalloway]

I stand by my statement about already-indexed data being unalterable.
Why do you say it is not entirely accurate?

[aferone]

I understand what you are saying, but it my case, it's sort of irrelevant. I was trying to solve a field extraction issue. Configuration on the Search Head was corrected, and that fixed the fields. In this case, it didn't matter how the data was indexed.