All Apps and Add-ons

Linux Auditd: How to override the default configurations for props.conf?

jcorkey
Explorer

When the Linux Auditd app is installed on a Splunk Enterprise (indexer), is the props.conf in the TA_linux-auditd/default/props.conf overriding anything by default? I am confused on how overriding works.

Splunk documentations says the following:

Note: If you forward data, and you want to assign a source type for a source, you must assign the source type in props.conf on the forwarder. If you do it in props.conf on the receiver, the override has no effect.

So if I have the Linux Auditd app installed on an indexer and I have a universal forwarder sending audit log data to my indexer, will any configuration I add in TA_linux-auditd/local be applied to data received from forwarders or data that my indexer itself is forwarding??

The NOTE above makes it sound like I need to install Linux Auditd app on my forwarder not just my indexer.

0 Karma

woodcock
Esteemed Legend

The documentation is wrong. You should assign the sourcetype in inputs.conf on the forwarder (NOT in props.conf). Then don't bother overriding it at all.

0 Karma

dilipbailwal
Path Finder

First of all overriding works as per the files presedence order. In your case it will be index file precedence order.
1. Slave-app local directories (cluster peers only) -- highest priority
2. System local directory
3. App local directories
4. Slave-app default directories (cluster peers only)
5. App default directories
6. System default directory -- lowest priority

Hope this answers, if not then please rephrase ur question

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...