Getting Data In

Moving a search head pooling Windows environment to a Linux environment, where are my props.conf applied on these servers?

banderson7
Communicator

Trying to get a Windows environment moved into a Linux environment, and having problems finding where props.conf is applied to the data. There's no props.conf in local on the search heads, the cluster head or the indexers. Nor are there props.conf in the apps directory of those servers. The search heads are pooled, so I checked the following location: c:\dfsroot\SearchHeadPooling\etc\apps\search\local\props.conf, but it only has field extractions created inside splunk.
There's no app on the deployment server that includes a props.conf.
Where the deuce are these properties being applied?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try getting the information with btool.

./splunk btool props list --debug

This should list all your properties and respective files. Please note, props are applied either at index or search time.

Consolidated information about the props are available in wiki http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Try getting the information with btool.

./splunk btool props list --debug

This should list all your properties and respective files. Please note, props are applied either at index or search time.

Consolidated information about the props are available in wiki http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

Happy Splunking!

renjith_nair
SplunkTrust
SplunkTrust

Does it help?

Happy Splunking!
0 Karma

banderson7
Communicator

Yes thank you! Found out that I didn't have any custom props in this environment period. These people are weird.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>