I have added props and tranforms.conf in $SPLUNK_HOME/splunk/etc/system/local.
Am having the following error on restarting splunk:
Splunk> Map. Reduce. Recycle.
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
(skipping validation of index paths because not running as emtelorg\emteladmin)
Validated: _audit _internal _introspection _telemetry _thefishbucket history main summary
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Invalid key in stanza [WinEventLog:Security] in C:\Program Files\Splunk\etc\system\local\props.conf, line 3: {{TRANSFORMS- (value: ).
Invalid key in stanza [ ] in C:\Program Files\Splunk\etc\system\local\transforms.conf, line 3: {{REGEX (value: "EventCode=(5156|4634|4672)").
Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
Done
Checking default conf files for edits...
Validating installed files against hashes from 'C:\Program Files\Splunk\splunk-7.2.3-06d57c595b80-windows-64-manifest'
All installed files intact.
Done
All preliminary checks passed.
Starting splunk server daemon (splunkd)...
... View more