Getting Data In

Where does props.conf need to exist in a distributed deployment?

pfabrizi
Path Finder

I think I need to push this from the deployment to each device or at least the forwarder and search head.

I have 5 servers making up my SPLUNK Enterprise deployment, 1 SH, 1 FW, 1 DS, 2 Indexers.

My props.conf on the forwarder has this configuration for 1 data source:
FIELDALIAS-severity_as_id = severity as severity_id
FIELDALIAS-dst_as_dest = dst as dest
EVAL-app = netwitness
EXTRACT-subject = CEF:\s+\d(?:|[^|]+){3}|(?[^|]+)

When I search I am not seeing the 'subject' does this need to be pushed to the search head? how about the other devices. I am trying to understand this.

Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

All the configuration in props.conf you have is "Search time field extraction" related configurations so they should be deployed to your search head (only), not in forwarder. A restart of search head instance will be required if you push the configuration manually (or need to ensure that instance gets restarted if using DS).

View solution in original post

0 Karma

somesoni2
Revered Legend

All the configuration in props.conf you have is "Search time field extraction" related configurations so they should be deployed to your search head (only), not in forwarder. A restart of search head instance will be required if you push the configuration manually (or need to ensure that instance gets restarted if using DS).

0 Karma

pfabrizi
Path Finder

Thank You!

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...