An overview of Splunk .conf files
If you have spent any time in the filesystem investigating Splunk, you have seen many different files ending in
.conf. In this section, we will give a quick overview of the most common
.conf files. The official documentation is the best place to look for a complete reference of files and attributes.
The quickest way to find the official documentation is with your favorite search engine by searching for
splunk filename.conf. For example, a search for
splunk props.conf pulls up the Splunk documentation for
props.conf first in every search engine I tested.
The stanzas in
props.conf define which events to match based on
sourcetype. These stanzas are merged into the master configuration ...