Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Which props.conf for my .csv ?

hattori_hanzo
New Member

Hi

I have a .csv file without header but with fixed fields which i would like to send to my Splunk server with the universal forwarder on the according Linux host.

I understand that i need to configure the inputs.conf on the universal forwarder and that i need to define the .csv on the indexer in props.conf like following:

[mycsv]
FIELD_DELIMITER=,
FIELD_NAMES=field1,field2,field3,field4

However, it's not clear to me in which props.conf i need to define the above definition. I have found the following props.conf on my Indexer/Splunk server?

/opt/splunk/etc/apps/splunk_internal_metrics/default/props.conf
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf
/opt/splunk/etc/apps/search/default/props.conf
/opt/splunk/etc/apps/SplunkLightForwarder/default/props.conf
/opt/splunk/etc/apps/Splunk_TA_apache/default/props.conf
/opt/splunk/etc/apps/sample_app/default/props.conf
/opt/splunk/etc/apps/legacy/default/props.conf
/opt/splunk/etc/apps/splunk_instrumentation/default/props.conf
/opt/splunk/etc/apps/splunk_archiver/default/props.conf
/opt/splunk/etc/apps/splunk_monitoring_console/default/props.conf
/opt/splunk/etc/apps/learned/local/props.conf
/opt/splunk/etc/system/default/props.conf

Do i need to copy the props.conf from: /opt/splunk/etc/apps/search/default/props.conf
to: /opt/splunk/etc/system/default/props.conf and then modify it with my above [mycsv] definition?

Or do i need to modify the props.conf in: /opt/splunk/etc/apps/search/default/props.conf and leave it there?

Or do i need to modify the props.conf in: /opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf?

Or is it any of the other props.conf?

I only want to search the index after with the standard search in Splunk.

Kind Regards and thanks in advance for any help

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Never modify any configuration file in a default directory.

Do not copy an entire .conf file from default to local. Copy only the stanza name(s) and the attribute(s) you wish to change.
You can put the change in any app, but it should go in the app that is intended for that type of data. If you have your own data type then you can (and should) create your own app and put the .conf files there.

Putting custom config files in the Search & Reporting app ("search" directory) may cause problems in the future.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Never modify any configuration file in a default directory.

Do not copy an entire .conf file from default to local. Copy only the stanza name(s) and the attribute(s) you wish to change.
You can put the change in any app, but it should go in the app that is intended for that type of data. If you have your own data type then you can (and should) create your own app and put the .conf files there.

Putting custom config files in the Search & Reporting app ("search" directory) may cause problems in the future.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

hattori_hanzo
New Member

Thanks a lot @richgalloway

0 Karma

to4kawa
SplunkTrust
SplunkTrust
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!