Getting Data In

Why aren't my apps props.conf not being exported when using export = system?

inmanx09
New Member

My props.conf values are not being picked up by the Splunk search app. I currently have the following stanza set in

$SPLUNK_HOME/etc/apps//metadata

[]
access = read : [*], write : [admin]

[props]
export = system

My props.conf file looks like the following so far. I need the KV_MODE = none property to be picked up for my sourcetype.

[my_type]
KV_MODE = none

This works just fine when I put this in ./default/local. Can anyone tell me what I'm doing wrong so I can get this props.conf exported?

Thanks.

0 Karma

lakshman239
Influencer

you need to add your custom config to 'local' folder of your app and not 'default'

eg /opt/splunk/etc/apps/your_app/local OR /opt/splunk/etc/apps/search/local for testing

0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...