topic Re: Creating field extraction in Getting Data In

Creating field extraction

misteryuku — Thu, 29 Mar 2012 06:36:13 GMT

I would like to create a new field extraction through props.config for search app.
For example i want to retrieve a custom field called partner whenever i search for events in a source called sexydata and sourcetype = sexuality using the search app.

I created the new field extraction through this REST endpoint.
https://localhost:8089/servicesNS/admin/search/data/props/extractions?name=sexuality&stanza=partner&type=EXTRACT&partner=\[w+\](?[^:]+)

I don't understand why an HTTP 400 error was thrown when all the GET key=value parameters i appended to the url was thrown and the new field wasn't extracted.

Re: Creating field extraction

Ayn — Thu, 29 Mar 2012 06:52:08 GMT

First of all, I would advise you to start by defining these extractions directly in props.conf first to make sure your extractions are working properly before moving on to trying to set the extractions via the API. It makes troubleshooting easier.

Second, your syntax is wrong. The response body should give you some insight into this. As per the docs that you should have read, you should be giving the parameters as POST data, not GET. http://docs.splunk.com/Documentation/Splunk/4.3.1/RESTAPI/RESTknowledge#POST_data.2Fprops.2Fextractions

Re: Creating field extraction

misteryuku — Thu, 29 Mar 2012 06:57:06 GMT

that means the parameters are sent through HTTP request body?

Re: Creating field extraction

Ayn — Thu, 29 Mar 2012 06:58:13 GMT

Yes, as POST parameters which indeed are sent in the request body.

Re: Creating field extraction

misteryuku — Thu, 29 Mar 2012 07:06:51 GMT

I have done that however i don't see any changes to the props config file for the search app. Where do i see the changes?

Re: Creating field extraction

Ayn — Thu, 29 Mar 2012 07:11:27 GMT

Under the user you posted the changes as. So for instance if you used the user 'admin', the changes will be found in $SPLUNK_HOME/etc/users/admin/search/local/props.conf.

Re: Creating field extraction

Ayn — Thu, 29 Mar 2012 07:14:16 GMT

More info available here: http://docs.splunk.com/Documentation/Splunk/4.3.1/RESTAPI/RESTconfigurations

Re: Creating field extraction

misteryuku — Thu, 29 Mar 2012 07:20:56 GMT

So if i created the new field extractions through the props config file then that means whenever i retrieve the results from the search app via the search/jobs/{search_id}/results REST endpoint i will be able to see the field xml tags with field names extracted as the field attribute k value? Is that true??

Re: Creating field extraction

misteryuku — Thu, 29 Mar 2012 07:24:24 GMT

I go check it out.

Re: Creating field extraction

Ayn — Thu, 29 Mar 2012 07:25:32 GMT

Yes. You need to make sure to specify which fields you want to be returned in your search request, but the extractions will be persistent, yes.