indexer configuration

[sansri7680]

I created a new index in my splunk instance. I want to set some custom settings for event splitting in props.conf for the new index. which path should this props.conf go. Is it $SPLUNK_HOME/etc/apps/search/local or $SPLUNK_HOME/etc/system/local

Thanks in advance

[jonuwz · Accepted solution]

Either will work.

If it was an index for a custom application, you'd probably put the definition in etc/<app>/local

But since you mention the search app, and you're unlikely to remove/disable it, it doesn't really matter.

I tend to keep the "permanent" stuff in system/local