Getting Data In
Highlighted

props.conf issues

Champion

Hi,

I added some recent feeds, and they were working fine, but then I realized that I had put the props.conf on the universal forwarder, but they belong on the indexer. (This is correct, right?)

Once I moved my props.confs to the indexer, they stopped working correctly, so obviously, my props.conf has issues. I seem to recall a command to display the config that is being used splunk for a feed. Can someone provide that command?

Tags (1)
0 Karma
Highlighted

Re: props.conf issues

Motivator

splunk cmd btool props list -debug