Where is Indexer specific props.Conf files saved?

[ethanthomas]

Is there individual indexer specific conf files present specially for Props.conf file ?  In Linux , how can we identify the indexer specific conf files for a particular index ?

[scelikok]

Hi @ethanthomas,

I think you want which props setting has an effect on the indexer.  You can check the below wiki page, on this page parsing phase happens on indexers (or heavy forwarders). And as @richgalloway said, these settings are works by sourcetype not index.

https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

TRUNCATE, LINE_BREAKER, SHOULD_LINEMERGE, BREAK_ONLY_BEFORE_DATE, and all other line merging settings
TZ, DATETIME_CONFIG, TIME_FORMAT, TIME_PREFIX, and all other time extraction settings and rules
TRANSFORMS* which includes per-event queue filtering, per-event index assignment, per-event routing. Applied in the order defined
SEDCMD*
MORE_THAN*, LESS_THAN*

[richgalloway]

Typically, config files are neither index nor indexer specific.  Conf files belong to the system, an app, or a user rather than indexes or indexers.  To create an indexer-specific props.conf file, one would edit $SPLUNK_HOME/etc/system/local/props.conf on each indexer - something not advised in an indexer cluster.  To do the same for indexes, create a separate app for each index and have it contain a different props.conf file.

To find a props.conf file, use btool. This command will list all of the attributes from every props.conf file along with the name of the file from which it came.  Use grep to filter the output and you'll have the file path.

splunk btool --debug props list