I have a standalone Splunk environment - I have universal forwarders and an indexer/Deployment server which acts as the Search head also.
I have a deployment-app under $SPLUNK_HOME/etc/deployment-apps/my_inputs/local/inputs.conf and props.conf. The inputs.conf was recognized fine, but the props.conf changes weren't picked up.
When i put the props.conf under $SPLUNK_HOME/etc/apps/my-IDX/props.conf, alongside the indexes.conf, the changes were picked up.
Is there a reason why the props.conf wasn't picked up from deployment-app?
The basic reason why your props.conf didn't work when you placed it in deployment-apps is that the props configurations work while indexing the data and not while monitoring the file path, hence it should be placed in the app where your indexes.conf resides.
It sounds like you are trying to filter data at the Universal Forwarder level. I would recommend taking a look at the following Wiki page: https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
SEDCMD is done at the parsing phase, which takes place on a Heavyweight Forwarder or Indexer. So basically, SEDCMD cannot be used at the Universal Forwarder level.
The environment I'm currently making changes - is the lower env I have and I need to test here before rolling it out to Production servers. The same file props.conf worked when it was moved from deployment-apps/ to apps/. My preference would be to keep the props.conf where the inputs.conf are defined.
Hi mudragada, could you please clarify what you mean by "changes weren't picked up"? Is the issue that you are not seeing props.conf changes on the Universal Forwarder or that you are seeing the changes but they are not working properly?
Hi, may be my question was not clear. "changes weren't picked up" in the sense - the configuration didn't take effect and the logs were appearing as they were before. I introduced a SEDCMD-event1= and SEDCMD-event2= along with MAX_EVENTS.