Splunk Search

Splunk DS deletes props.conf on universal forwarder

alpeen_splunk
Explorer

Hello,

I use Splunk as Indexer and deployment server und I have one universal forwarder installed. 

I'm getting an error, when Splunk forwarder tries to read one log file: 

Ignoring file '/mnt/scn_data/log.txt' due to: binary

It works, after I put a file props.conf into app folder on the forwarder.

[cx_scan_logs]
CHARSET = UTF-16LE
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Custom

But after I made changes on the index server, the files on the forwarder like inputs.conf are updated and  props.conf is deleted. And I get the error again. 

How can I say the Splunk not to delete the props.conf on the forwarder?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @alpeen_splunk,

did you added the props.conf file only to the $SPLUNK_HOME/etc/apps/<your_app> folder or also to the  $SPLUNK_HOME/etc/deployment-apps folder?

If a client is managed by a DS, you have to put the apps to deploy in the $SPLUNK_HOME/etc/deployment-apps folder.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @alpeen_splunk,

did you added the props.conf file only to the $SPLUNK_HOME/etc/apps/<your_app> folder or also to the  $SPLUNK_HOME/etc/deployment-apps folder?

If a client is managed by a DS, you have to put the apps to deploy in the $SPLUNK_HOME/etc/deployment-apps folder.

Ciao.

Giuseppe

alpeen_splunk
Explorer

Hi Giuseppe,

thank you very much for your so quick replay!

I've copied props.conf from .../apps/MyApp/local folder to .../deployment-app/MyApp/local.

Now it works as expected.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alpeen_splunk,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...