Why is props.conf in my deployment-app not getting picked up?

[mudragada]

I have a standalone Splunk environment - I have universal forwarders and an indexer/Deployment server which acts as the Search head also.

I have a deployment-app under $SPLUNK_HOME/etc/deployment-apps/my_inputs/local/inputs.conf and props.conf. The inputs.conf was recognized fine, but the props.conf changes weren't picked up.

When i put the props.conf under $SPLUNK_HOME/etc/apps/my-IDX/props.conf, alongside the indexes.conf, the changes were picked up.

Is there a reason why the props.conf wasn't picked up from deployment-app?

[MJwhyno24]

You setup props.conf in deployment-apps only if you are managing your HF with deployment server But if you are managing it yourself then setup props in apps directory

[MousumiChowdhur]

Hi @mudragada,

The basic reason why your props.conf didn't work when you placed it in deployment-apps is that the props configurations work while indexing the data and not while monitoring the file path, hence it should be placed in the app where your indexes.conf resides.

Thanks!

[phadnett_splunk]

It sounds like you are trying to filter data at the Universal Forwarder level. I would recommend taking a look at the following Wiki page: https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

SEDCMD is done at the parsing phase, which takes place on a Heavyweight Forwarder or Indexer. So basically, SEDCMD cannot be used at the Universal Forwarder level.

[mudragada]

Also, the change that I made is on the indexer/deployment server. Not on the universal forwarder.

[phadnett_splunk]

Could you check the OS level permissions on props.conf compared to inputs.conf after the App is pushed from the Deployment Server to make sure they are consistent?

[mudragada]

-rw-r--r-- 1 splunk splunk 221 Jan 25 13:18 inputs.conf
-rw-r--r-- 1 splunk splunk 148 Jan 31 14:14 props.conf

Same permissions. Made sure of that.

[mudragada]

The environment I'm currently making changes - is the lower env I have and I need to test here before rolling it out to Production servers. The same file props.conf worked when it was moved from deployment-apps/ to apps/. My preference would be to keep the props.conf where the inputs.conf are defined.

[phadnett_splunk]

Hi mudragada, could you please clarify what you mean by "changes weren't picked up"? Is the issue that you are not seeing props.conf changes on the Universal Forwarder or that you are seeing the changes but they are not working properly?

[mudragada]

Hi, may be my question was not clear. "changes weren't picked up" in the sense - the configuration didn't take effect and the logs were appearing as they were before. I introduced a SEDCMD-event1= and SEDCMD-event2= along with MAX_EVENTS.