Hi @Avantika , when I said "located on" I meant in which server, as also @kiran_panchavat pointed on, they must be ocated in the first Heavy Forwarders they are passing through, or (only if there is...
See more...
Hi @Avantika , when I said "located on" I meant in which server, as also @kiran_panchavat pointed on, they must be ocated in the first Heavy Forwarders they are passing through, or (only if there isn't any HF) on the Indexers. Then, your path, is very strange, it doesn't seem to be a Splunk app, the props.conf and transforms.conf files must be located in this path: $SPLUNK_HOME/etc/apps/<your_app>/local Ciao. Giuseppe