Refine your search:

12
8

If I have a forwarder, a light forwarder, an indexer, and a search head, where do I need to make my configuration, particular those in props.conf and inputs.conf? Can each setting be done anywhere, or only some places? Does it make a difference where it is set? What happens if the settings are different in each place?

Are the answers to the above questions different for each setting, and if so, is there a listing of these answers anywhere?

Update: I will be offering a bounty on this question. Winning the bounty will require a comprehensive and reasonably easy to read table or chart documenting substantially all inputs.conf and props.conf properties and keys, any significant related ones from other places (such as transforms.conf, outputs.conf). It should indicate where and how the property must be set, where/how it may be set, and what takes precedence in case of conflicts. The properties documented should include:

  • source
  • sourcetype
  • host
  • index
  • queue
  • route / _TCP_ROUTING
  • the above for WMI inputs
  • time zone / TZ
  • time stamp extraction rules
  • line breaking rules
  • line merging rules
  • character set/CHARSET
  • extracted fields
  • transformed fields
  • data masking
  • segmentation

asked 15 Jan '10, 19:22

gkanapathy's gravatar image

gkanapathy ♦
26.2k1622
accept rate: 42%

edited 21 Jan '10, 06:05


One Answer:

More detailed and extensive answer here: http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F

Light Forwarder
Inputs.conf changes need to be made on the forwarder Props.conf (and corresponding references in transforms.conf) changes need to be made on the indexer

Forwarder
Inputs.conf changes need to be made on the forwarder Props.conf (and corresponding references in transforms.conf) changes need to be made on the forwarder

Indexer
Inputs.conf changes need to be made on the indexer Props.conf is needed for index time extractions

Search Head
Inputs.conf is not necessarily needed, you only need to deal with it if you want to collect data on this instance Props.conf is needed for all your search time extractions (field extractions being the obvious the example)

The spec file for the conf in question can usually clue in to where the settings need to be made

link

answered 18 Jan '10, 07:16

matt's gravatar image

matt ♦♦
3.1k2427
accept rate: 82%

edited 12 Mar '10, 21:05

gkanapathy's gravatar image

gkanapathy ♦
26.2k1622

Could you please edit that, to add linebreaks? :-) Thank you.

(18 Jan '10, 18:24) V_at_Splunk
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×309

Asked: 15 Jan '10, 19:22

Seen: 1,332 times

Last updated: 03 Nov '11, 07:20

Copyright © 2005-2012 Splunk, Inc. All rights reserved.