Getting Data In

Setting up props.conf at the heavy forwarders

vr2312
Contributor

I have an app to which the basic inputs.conf were set and the app was forwarding logs to the indexers without any issues.

Then the format of the logs changed due to which i had to write a props.conf.

The regex were tested in the test environment and the same were deployed inside the app.

I now see that the production logs are still not accommodating the props.conf and the logs are still populating without using the line breakers.

Question : Should i be pushing the props.conf to the heavy forwarders too ? If yes, How ?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi vr2312,
You have to send props.conf also to the HF.
you can do it creating a dedicated ServerClass to distribute an appropriate TA using your Deployment Server.
Be aware to one issue: if you use your HFs to ingest syslogs with a load balancer, when you restart Splunk on HFs you lose some events because all HFs are restarted at the same time; so, if you haven't many HFs, maybe, it could be better to manually update them one by one.
Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi vr2312,
You have to send props.conf also to the HF.
you can do it creating a dedicated ServerClass to distribute an appropriate TA using your Deployment Server.
Be aware to one issue: if you use your HFs to ingest syslogs with a load balancer, when you restart Splunk on HFs you lose some events because all HFs are restarted at the same time; so, if you haven't many HFs, maybe, it could be better to manually update them one by one.
Bye.
Giuseppe

vr2312
Contributor

Thank you. I have forwarded the same. Let me see if the changes gets accommodated now.

Also, thanks for the additional input 🙂

Will keep you posted on the changes.

0 Karma

inventsekar
Ultra Champion

may i know, if you have restarted splunk on the UF after updating props.conf?,
you must restart Splunk to enable configurations.

0 Karma

vr2312
Contributor

Yes. The forwarders were restarted.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...