Splunk Enterprise

Editing props.conf & transforms.conf configuration file

misteryuku
Communicator

I found that both props.conf & transforms.conf config files are found the $SPLUNK_HOME/etc/system/default/ directory. I would like to create search time field extraction through those two config files in that location. However, the doc
http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Createandmaintainsearch-timefieldextract...

says Note: Do not edit files in $SPLUNK_HOME/etc/system/default/.

So can i still create search time field extraction through those two config files in $SPLUNK_HOME/etc/system/default/ ????

Tags (1)

Damien_Dallimor
Ultra Champion

Create a props.conf and transforms.conf in $SPLUNK_HOME/etc/system/local and edit them there.

If $SPLUNK_HOME/etc/system/local does not exist, then create the directory.

misteryuku
Communicator

okay.kkkkkkk

0 Karma

Ayn
Legend

Well that depends on the change you want to make. If the changes you are making are made in transforms.conf and props.conf, then those are the files you should put there. NOTE that you don't need to copy an existing config file there, just create your own with the config values you want to set. These values will be merged with the configuration values found in other files.

0 Karma

misteryuku
Communicator

The Splunk Doc on the About configuration files says :
"If you want to edit a configuration file such that the change only applies to a certain app, copy the file to the app's /local directory and make your changes there."

How do i know which file i should copy to the app local directory?

0 Karma

misteryuku
Communicator

If i want to create search time field extraction for the SEARCH APP through those two config files in that location then i have to create the props.conf and transform.conf in
this directory :
$SPLUNK_HOME/etc/apps/search/local/

Is it??

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...