Do props.conf and transforms.conf need to be created in $SPLUNK_HOME/etc/deployment-apps/YOURAPP/local or can it be created in the deployment server GUI to push to indexers?
Hi lmjoin,
The answer here would be a it depends
😉
To a certain extend you can use the Splunk UI to create props and transforms, BUT those files will most likely be located in $SPLUNK_HOME/etc/apps/<appnamehere>/local/
.
So, you will have to copy/move them into $SPLUNK_HOME/etc/deployment-apps/
to make them available for the deployment server.
Personally I just create them directly in $SPLUNK_HOME/etc/deployment-apps/<appnamehere>/local/
.
Hope this helps ...
cheers, MuS