Getting Data In

Where does props.conf need to exist in a distributed deployment?

pfabrizi
Path Finder

I think I need to push this from the deployment to each device or at least the forwarder and search head.

I have 5 servers making up my SPLUNK Enterprise deployment, 1 SH, 1 FW, 1 DS, 2 Indexers.

My props.conf on the forwarder has this configuration for 1 data source:
FIELDALIAS-severity_as_id = severity as severity_id
FIELDALIAS-dst_as_dest = dst as dest
EVAL-app = netwitness
EXTRACT-subject = CEF:\s+\d(?:|[^|]+){3}|(?[^|]+)

When I search I am not seeing the 'subject' does this need to be pushed to the search head? how about the other devices. I am trying to understand this.

Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

All the configuration in props.conf you have is "Search time field extraction" related configurations so they should be deployed to your search head (only), not in forwarder. A restart of search head instance will be required if you push the configuration manually (or need to ensure that instance gets restarted if using DS).

View solution in original post

0 Karma

somesoni2
Revered Legend

All the configuration in props.conf you have is "Search time field extraction" related configurations so they should be deployed to your search head (only), not in forwarder. A restart of search head instance will be required if you push the configuration manually (or need to ensure that instance gets restarted if using DS).

View solution in original post

0 Karma

pfabrizi
Path Finder

Thank You!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!