Getting Data In

props.conf issues

a212830
Champion

Hi,

I added some recent feeds, and they were working fine, but then I realized that I had put the props.conf on the universal forwarder, but they belong on the indexer. (This is correct, right?)

Once I moved my props.confs to the indexer, they stopped working correctly, so obviously, my props.conf has issues. I seem to recall a command to display the config that is being used splunk for a feed. Can someone provide that command?

Tags (1)
0 Karma

gfuente
Motivator

splunk cmd btool props list -debug

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...