My props.conf values are not being picked up by the Splunk search app. I currently have the following stanza set in
$SPLUNK_HOME/etc/apps//metadata
[]
access = read : [*], write : [admin]
[props]
export = system
My props.conf file looks like the following so far. I need the KV_MODE = none property to be picked up for my sourcetype.
[my_type]
KV_MODE = none
This works just fine when I put this in ./default/local. Can anyone tell me what I'm doing wrong so I can get this props.conf exported?
Thanks.
↧