O'Reilly logo

Implementing Splunk - Second Edition by James D Miller, Vincent Bumgarner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

An overview of Splunk .conf files

If you have spent any length of time in the filesystem investigating Splunk, you must have seen many different files ending in .conf. In this section, we will give you a quick overview of the most common .conf files. The official documentation is the best place to look for a complete reference to files and attributes.

The quickest way to find the official documentation is with your favorite search engine by searching for splunk filename.conf. For example, a search for splunk props.conf pulled up (and will pull up) the Splunk documentation for props.conf first in every search engine I tested.

props.conf

The stanzas in props.conf define which events to match based on host, source, and sourcetype. These stanzas are ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required