Getting Data In

path of props.conf for applications in indexer.

rrmavani
Engager

In our environment,

We have Universal forwarder, Indexers and search head.

We have different approximate 20-22 splunk apps for different kind of configurations.

All apps are configured In Universal Forwarders at '/opt/splunkforwarder/etc/apps/'

No Apps are configured in indexers.

For each applications, props.conf are configured separately.

Some threads are saying "time stamping" and "line breaking" should be configured in indexers only not in UF.

Where should I place the props.conf in indexer for "time stamping" and "line breaking" for each splunk apps. ?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Timestamping and line breaking happens during parsing, so those need to reside on the indexers.

See http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for a decent writeup of what goes where.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Timestamping and line breaking happens during parsing, so those need to reside on the indexers.

See http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for a decent writeup of what goes where.

View solution in original post

linu1988
Champion

Until and unless you have a heavy forwarder please exclude transforms/props.conf in forwarder. It should always exist in the indexer. And as Martin mentioned you can copy everything into one props.conf and put them in system/local directory

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can put it into system/local, but if it belongs to an app called glassfish it'd be more at home in apps/glassfish/local - regardless of whether you're on a UF, indexer, or SH.

0 Karma

rrmavani
Engager

ok..
So you mean

in forwarder I can put at '/opt/splunkforwarder/etc/apps/glassfish/local/props.conf'

in indexer I can put at

'/opt/splunk/etc/system/local/props.conf'

is my understanding right ??

0 Karma

linu1988
Champion

you can place it where ever you want, but it shouldn't be repeated meant the same stanzas in different props.conf. for maintainability you can club everything in a single props.conf and transforms.conf and put it in system app or search app.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Without knowing the apps, probably.

0 Karma

rrmavani
Engager

so do I need to configure and install the apps in indexer also ??

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Same path, $SPLUNK_HOME/etc/apps/app_name/local/props.conf.

0 Karma

rrmavani
Engager

Yes but what is the path of props.conf in indexer (for the applications configured in UF) ??

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!