If you have spent any time in the filesystem investigating Splunk, you have seen many different files ending in
.conf. In this section, we will give a quick overview of the most common
.conf files. The official documentation is the best place to look for a complete reference of files and attributes.
The quickest way to find the official documentation is with your favorite search engine by searching for
splunk filename.conf. For example, a search for
splunk props.conf pulls up the Splunk documentation for
props.conf first in every search engine I tested.
The stanzas in
props.conf define which events to match based on
sourcetype. These stanzas are merged into the master configuration ...