Splunk Enterprise

Editing props.conf & transforms.conf configuration file

misteryuku
Communicator

I found that both props.conf & transforms.conf config files are found the $SPLUNK_HOME/etc/system/default/ directory. I would like to create search time field extraction through those two config files in that location. However, the doc
http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Createandmaintainsearch-timefieldextract...

says Note: Do not edit files in $SPLUNK_HOME/etc/system/default/.

So can i still create search time field extraction through those two config files in $SPLUNK_HOME/etc/system/default/ ????

Tags (1)

Damien_Dallimor
Ultra Champion

Create a props.conf and transforms.conf in $SPLUNK_HOME/etc/system/local and edit them there.

If $SPLUNK_HOME/etc/system/local does not exist, then create the directory.

misteryuku
Communicator

okay.kkkkkkk

0 Karma

Ayn
Legend

Well that depends on the change you want to make. If the changes you are making are made in transforms.conf and props.conf, then those are the files you should put there. NOTE that you don't need to copy an existing config file there, just create your own with the config values you want to set. These values will be merged with the configuration values found in other files.

0 Karma

misteryuku
Communicator

The Splunk Doc on the About configuration files says :
"If you want to edit a configuration file such that the change only applies to a certain app, copy the file to the app's /local directory and make your changes there."

How do i know which file i should copy to the app local directory?

0 Karma

misteryuku
Communicator

If i want to create search time field extraction for the SEARCH APP through those two config files in that location then i have to create the props.conf and transform.conf in
this directory :
$SPLUNK_HOME/etc/apps/search/local/

Is it??

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...