Hi,everyone
I have an distributed environment.
one search header one forwarder and six indexer.
After i config props.conf in search header, wheather i need to copy props.conf to the six indexer?
Same question as limits.conf and index.conf.
I fount even if i didn`t copy props.conf to indexer, i still can use the difined field to search.
But if this,will the performance worse than copy props.conf to indexer?
Thanks.
Some props configurations had to be in the SH and other had to be in the IDX, so you just need to configure the settings in the right place.
Check this:
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
Regards
search  head distribute knowledge bundles(system, apps, users directory) to indexers when connection is established.
Indexed related things you  can configure in indexers like set the size of an index etc...
search time field extration  distribute to indexer by search head  when connection is established with indexer
