Editing props.conf & transforms.conf configuration file

[misteryuku]

I found that both props.conf & transforms.conf config files are found the $SPLUNK_HOME/etc/system/default/ directory. I would like to create search time field extraction through those two config files in that location. However, the doc
http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Createandmaintainsearch-timefieldextract...

says Note: Do not edit files in $SPLUNK_HOME/etc/system/default/.

So can i still create search time field extraction through those two config files in $SPLUNK_HOME/etc/system/default/ ????

[Damien_Dallimor]

Create a props.conf and transforms.conf in $SPLUNK_HOME/etc/system/local and edit them there.

If $SPLUNK_HOME/etc/system/local does not exist, then create the directory.

[misteryuku]

okay.kkkkkkk

[Ayn]

Well that depends on the change you want to make. If the changes you are making are made in transforms.conf and props.conf, then those are the files you should put there. NOTE that you don't need to copy an existing config file there, just create your own with the config values you want to set. These values will be merged with the configuration values found in other files.

[misteryuku]

The Splunk Doc on the About configuration files says :
"If you want to edit a configuration file such that the change only applies to a certain app, copy the file to the app's /local directory and make your changes there."

How do i know which file i should copy to the app local directory?

[misteryuku]

If i want to create search time field extraction for the SEARCH APP through those two config files in that location then i have to create the props.conf and transform.conf in
this directory :
$SPLUNK_HOME/etc/apps/search/local/

Is it??