Getting Data In

path of props.conf for applications in indexer.

rrmavani
Engager

In our environment,

We have Universal forwarder, Indexers and search head.

We have different approximate 20-22 splunk apps for different kind of configurations.

All apps are configured In Universal Forwarders at '/opt/splunkforwarder/etc/apps/'

No Apps are configured in indexers.

For each applications, props.conf are configured separately.

Some threads are saying "time stamping" and "line breaking" should be configured in indexers only not in UF.

Where should I place the props.conf in indexer for "time stamping" and "line breaking" for each splunk apps. ?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Timestamping and line breaking happens during parsing, so those need to reside on the indexers.

See http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for a decent writeup of what goes where.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Timestamping and line breaking happens during parsing, so those need to reside on the indexers.

See http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for a decent writeup of what goes where.

linu1988
Champion

Until and unless you have a heavy forwarder please exclude transforms/props.conf in forwarder. It should always exist in the indexer. And as Martin mentioned you can copy everything into one props.conf and put them in system/local directory

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can put it into system/local, but if it belongs to an app called glassfish it'd be more at home in apps/glassfish/local - regardless of whether you're on a UF, indexer, or SH.

0 Karma

rrmavani
Engager

ok..
So you mean

in forwarder I can put at '/opt/splunkforwarder/etc/apps/glassfish/local/props.conf'

in indexer I can put at

'/opt/splunk/etc/system/local/props.conf'

is my understanding right ??

0 Karma

linu1988
Champion

you can place it where ever you want, but it shouldn't be repeated meant the same stanzas in different props.conf. for maintainability you can club everything in a single props.conf and transforms.conf and put it in system app or search app.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Without knowing the apps, probably.

0 Karma

rrmavani
Engager

so do I need to configure and install the apps in indexer also ??

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Same path, $SPLUNK_HOME/etc/apps/app_name/local/props.conf.

0 Karma

rrmavani
Engager

Yes but what is the path of props.conf in indexer (for the applications configured in UF) ??

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...