KV_MODE=json

[splunklearner]

Hello,

I wanted to know where I should keep this attribute KV_MODE=json to extract the json fields automatically? In Deployment server or manager node or deployer?

We have props.conf in a app in DS. DS push that app to manager node. And manager will distribute that app to peer nodes. Can I add this in that props.conf?

Or any alternative please suggest.

[kiran_panchavat]

@splunklearner 

To extract key-value pairs from JSON data during searches, configure props.conf with KV_MODE=JSON. If you have a Splunk deployment with a Search Head Cluster (SHC), use the deployer to push this configuration to all search heads. Keep in mind that props.conf on Universal Forwarders has limited functionality.

refer this 

https://www.aplura.com/assets/pdf/where_to_put_props.pdf 

[splunklearner]

Hi @kiran_panchavat ,

We already have props.conf for same sourcetype in a app in DS which we push to manager node and manager will distribute to indexers. 

Now my question is can I include my kv_mode in same props.conf and push it to deployer (so that it will push to SHs) but it has line breaker bla bla in it.

or

should I create new app in deployer and then in local new props.conf and push it to SHs?

And we need all data (all sourcetypes) to follow this KV_MODE=json... Is there any way I can give by default rather than specifying each sourcetype seperately?

[isoutamo]

You can deploy the same props.conf to all nodes if you want. Each node use that part of it which have configuration which affects its behavior. Of course you must ensure that you don’t set twice e.g json handling with different way one for indexing and another for search. This leads you to see duplicate events.

[splunklearner]

@isoutamo but if give same props.conf with KV_MODE=json and distribute it to both indexers and search heads, will it lead to duplication of events or is it fine? 

[splunklearner]

Second point I didn't get you. We have a seperate syslog server where UF is installed and from there logs will be forwarded to our DS. what can I do now?

Do I need to give props.conf on both deployer and forwarder?

[gcusello]

Hi @splunklearner ,

the props.conf must be deployed to the Search Heads (using the SHC-Deployer if you have a cluster).

and to the Forwarder that ingest logs, using the DS.

Ciao.

Giuseppe