Can props.conf and indexes.conf be split for more clear structure?

[yAlff]

Hi,
as mentioned in the title I'm wondering, if the props.conf or indexes.conf can be split for a more clear structure. Does anybody do this?
Best regards,
Yannic

[woodcock]

Yes, you should not be using/putting these files inside of $SPLUNK_HOME/etc/system/local/ which has global scope. Instead you should be creating your own app, something like $SPLUNK_HOME/etc/system/apps/myApp/default/ and creating your input/sourcetype/app-specific configurations inside configuration files that are put there.

[jacobwilkins]

In a larger deployment it is best practice to create custom TA apps to use as containers for configurations that are logically grouped together. Monolithic configuration in $SPLUNK_HOME/system/local becomes unmaintainable, should be avoided.

Your configurations should be deployed to $SPLUNK_HOME/etc/apps, similar to this:

└── apps
    ├── TA-thing1
    │   ├── local
    │   │   ├── app.conf
    │   │   ├── indexes.conf
    │   │   ├── props.conf
    │   │   └── transforms.conf
    │   └── metadata
    │       └── local.meta
    └── TA-thing2
        ├── local
        │   ├── app.conf
        │   ├── indexes.conf
        │   └── props.conf
        └── metadata
            └── local.meta

Check out this Wiki article for some info on building a simple config app: http://wiki.splunk.com/Community:Creating_your_first_application

[skoelpin]

Do you mean have 2 separate props.conf files? If so then no. Why don't you just keep it in one file and seperate your stanza by comments with stars in them like this?

#************************
#
#
#  Edited by: 
#  Modified index 
#  8/6/2015
#
#
#*************************

[host:: srv-dcr01]
.........
.........
........

[jeffland]

Since you can't have more than one file with the name props.conf in the same folder, you can't directly split them. Also, using system/local and apps/search/local might help you but it could also have implications regarding the application of the settings (due to different configuration file precedence).

You can however arrange and separate the contents of your files with comments, much like the files in the default folder do:

# # # # # # # # # # # # # # #
# This section is for foo.  #
# # # # # # # # # # # # # # #

[stanza]
setting = foo

[stanza]
setting = bar

# # # # # # # # # # # # # # #
# This section is for bar.  #
# # # # # # # # # # # # # # #

[stanza]
setting = baz

You can also keep emtpy lines to help with the visibility.