path of props.conf for applications in indexer.

[rrmavani]

In our environment,

We have Universal forwarder, Indexers and search head.

We have different approximate 20-22 splunk apps for different kind of configurations.

All apps are configured In Universal Forwarders at '/opt/splunkforwarder/etc/apps/'

No Apps are configured in indexers.

For each applications, props.conf are configured separately.

Some threads are saying "time stamping" and "line breaking" should be configured in indexers only not in UF.

Where should I place the props.conf in indexer for "time stamping" and "line breaking" for each splunk apps. ?

[martin_mueller · Accepted solution]

Timestamping and line breaking happens during parsing, so those need to reside on the indexers.

See http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for a decent writeup of what goes where.

[linu1988]

Until and unless you have a heavy forwarder please exclude transforms/props.conf in forwarder. It should always exist in the indexer. And as Martin mentioned you can copy everything into one props.conf and put them in system/local directory

[gkanapathy]

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfiledirectories

[martin_mueller]

You can put it into system/local, but if it belongs to an app called glassfish it'd be more at home in apps/glassfish/local - regardless of whether you're on a UF, indexer, or SH.

[rrmavani]

ok..
So you mean

in forwarder I can put at '/opt/splunkforwarder/etc/apps/glassfish/local/props.conf'

in indexer I can put at

'/opt/splunk/etc/system/local/props.conf'

is my understanding right ??

[linu1988]

you can place it where ever you want, but it shouldn't be repeated meant the same stanzas in different props.conf. for maintainability you can club everything in a single props.conf and transforms.conf and put it in system app or search app.

[martin_mueller]

Without knowing the apps, probably.

[rrmavani]

so do I need to configure and install the apps in indexer also ??

[martin_mueller]

Same path, $SPLUNK_HOME/etc/apps/app_name/local/props.conf.

[rrmavani]

Yes but what is the path of props.conf in indexer (for the applications configured in UF) ??