If you have spent any length of time in the filesystem investigating Splunk, you must have seen many different files ending in .conf
. In this section, we will give you a quick overview of the most common .conf
files. The official documentation is the best place to look for a complete reference to files and attributes.
The quickest way to find the official documentation is with your favorite search engine, by searching for Splunk filename.conf
. For example, a search for Splunk props.conf
pulled up (and will pull up) the Splunk documentation for props.conf
first in every search engine I tested.
The stanzas in props.conf
define which events to match based on host, source, and sourcetype. These stanzas are merged into the master configuration based on the uniqueness of stanza and attribute names, as with any other configuration, but there are specific rules governing when each stanza is applied to an event and in what order. Stated as simply as possible...