If you have spent any length of time in the filesystem investigating Splunk, you must have seen many different files ending in .conf. In this section, we will give you a quick overview of the most common
.conf files. The official documentation is the best place to look for a complete reference to files and attributes.
The quickest way to find the official documentation is with your favorite search engine by searching for splunk
filename.conf. For example, a search for splunk
props.conf pulled up (and will pull up) the Splunk documentation for
props.conf first in every search engine I tested.
The stanzas in
props.conf define which events to match based on host, source, and sourcetype. These stanzas are ...