Splunk Enterprise

Editing props.conf & transforms.conf configuration file

misteryuku
Communicator

I found that both props.conf & transforms.conf config files are found the $SPLUNK_HOME/etc/system/default/ directory. I would like to create search time field extraction through those two config files in that location. However, the doc
http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Createandmaintainsearch-timefieldextract...

says Note: Do not edit files in $SPLUNK_HOME/etc/system/default/.

So can i still create search time field extraction through those two config files in $SPLUNK_HOME/etc/system/default/ ????

Tags (1)

Damien_Dallimor
Ultra Champion

Create a props.conf and transforms.conf in $SPLUNK_HOME/etc/system/local and edit them there.

If $SPLUNK_HOME/etc/system/local does not exist, then create the directory.

misteryuku
Communicator

okay.kkkkkkk

0 Karma

Ayn
Legend

Well that depends on the change you want to make. If the changes you are making are made in transforms.conf and props.conf, then those are the files you should put there. NOTE that you don't need to copy an existing config file there, just create your own with the config values you want to set. These values will be merged with the configuration values found in other files.

0 Karma

misteryuku
Communicator

The Splunk Doc on the About configuration files says :
"If you want to edit a configuration file such that the change only applies to a certain app, copy the file to the app's /local directory and make your changes there."

How do i know which file i should copy to the app local directory?

0 Karma

misteryuku
Communicator

If i want to create search time field extraction for the SEARCH APP through those two config files in that location then i have to create the props.conf and transform.conf in
this directory :
$SPLUNK_HOME/etc/apps/search/local/

Is it??

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...