Why doesn't my Ingest Action work?

[gerrysr6]

I have written and tested some rules using "Ingest Actions". I used the "Sample" indexed data and everything seems fine, so I saved my rules. 

There is a button "Deploy" with one option, Export for Manual Deployment.

Do I have to do that?

[richgalloway · Accepted solution]

Yes, you must deploy Ingest Actions to the indexers for them to work.  See https://docs.splunk.com/Documentation/Splunk/9.1.2/Data/DataIngest#Deploy_a_ruleset_on_an_indexer_cl...

[charleswatts]

I see your answer as "Yes" and reference a Splunk Enterprise doc.  Can you give an answer for the Splunk Cloud Platform.  While I see the deploy button in the top right, I do not see where i can edit the props.conf and the transforms.conf files or is cloud different?

[richgalloway]

There's no need to edit props or transforms for Ingest Actions as they can be configured easily using the UI.  In fact, use of the UI is recommended to avoid errors in the ruleset config.  If you need to edit the config files for Splunk Cloud, do so in a custom app and upload the app to your Splunk Cloud search head.

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Data/DataIngest#Deploy_a_ruleset_on_an_in...

[Esky73]

Do you need to deploy to indexers (as well) ? when there is an intermediary HF ?
All my config is on a HF 

[richgalloway]

A unique feature of Ingest Actions is that they apply to cooked data.  That means they can be installed on indexers and still work on events that come from an HF.