Hello
I develop a Splunk apps on a DEV platform
In this apps, I am doing field extractions and log file parsing.
As a consequence, props.conf and transforms.conf files are regularly modified.
If I want that my Splunk apps works fine in Production, do I have also to update props.conf and transforms.conf in my forwarder? Or on my indexer? Or both in forwarder and indexer ?
Thanks a lot
It depends. For search-time props the settings must be installed on a search head. Other settings go on the indexer. If the forwarder is a heavy forwarder then the same settings go there as well. Some settings, such as EVENT_BREAKER, go on universal forwarders.
See https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for more information.
It depends. For search-time props the settings must be installed on a search head. Other settings go on the indexer. If the forwarder is a heavy forwarder then the same settings go there as well. Some settings, such as EVENT_BREAKER, go on universal forwarders.
See https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F for more information.