Getting Data In

Where does props.conf need to exist in a distributed deployment?

pfabrizi
Path Finder

I think I need to push this from the deployment to each device or at least the forwarder and search head.

I have 5 servers making up my SPLUNK Enterprise deployment, 1 SH, 1 FW, 1 DS, 2 Indexers.

My props.conf on the forwarder has this configuration for 1 data source:
FIELDALIAS-severity_as_id = severity as severity_id
FIELDALIAS-dst_as_dest = dst as dest
EVAL-app = netwitness
EXTRACT-subject = CEF:\s+\d(?:|[^|]+){3}|(?[^|]+)

When I search I am not seeing the 'subject' does this need to be pushed to the search head? how about the other devices. I am trying to understand this.

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

All the configuration in props.conf you have is "Search time field extraction" related configurations so they should be deployed to your search head (only), not in forwarder. A restart of search head instance will be required if you push the configuration manually (or need to ensure that instance gets restarted if using DS).

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

All the configuration in props.conf you have is "Search time field extraction" related configurations so they should be deployed to your search head (only), not in forwarder. A restart of search head instance will be required if you push the configuration manually (or need to ensure that instance gets restarted if using DS).

0 Karma

pfabrizi
Path Finder

Thank You!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...