topic Re: listing properties for a pre-trained sourcetype in Getting Data In

listing properties for a pre-trained sourcetype

a212830 — Tue, 01 Jul 2014 15:19:20 GMT

Hi,

Is there a way to list the properties for a pre-trained sourcetypes?

Re: listing properties for a pre-trained sourcetype

martin_mueller — Tue, 01 Jul 2014 15:33:28 GMT

You can use btool, for example:

$ $SPLUNK_HOME/bin/splunk cmd btool props list access_combined_wcookie
[access_combined_wcookie]
ANNOTATE_PUNCT = True
BREAK_ONLY_BEFORE =
BREAK_ONLY_BEFORE_DATE = True
CHARSET = AUTO
DATETIME_CONFIG = \etc\datetime.xml
HEADER_MODE =
LEARN_SOURCETYPE = true
LINE_BREAKER_LOOKBEHIND = 100
MAX_DAYS_AGO = 2000
MAX_DAYS_HENCE = 2
MAX_DIFF_SECS_AGO = 3600
MAX_DIFF_SECS_HENCE = 604800
MAX_EVENTS = 256
MAX_TIMESTAMP_LOOKAHEAD = 128
MUST_BREAK_AFTER =
MUST_NOT_BREAK_AFTER =
MUST_NOT_BREAK_BEFORE =
REPORT-access = access-extractions
SEGMENTATION = indexing
SEGMENTATION-all = full
SEGMENTATION-inner = inner
SEGMENTATION-outer = outer
SEGMENTATION-raw = none
SEGMENTATION-standard = standard
SHOULD_LINEMERGE = False
TIME_PREFIX = \[
TRANSFORMS =
TRUNCATE = 10000
detect_trailing_nulls = auto
maxDist = 100

Same with looking at the REPORT-access = access-extractions config mentioned above:

$ $SPLUNK_HOME/bin/splunk cmd btool transforms list access-extractions
[access-extractions]
CAN_OPTIMIZE = True
CLEAN_KEYS = True
DEFAULT_VALUE =
DEST_KEY =
FORMAT =
KEEP_EMPTY_VALS = False
LOOKAHEAD = 4096
MV_ADD = False
REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[access-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?<referer>[[bc_domain:referer_]]?+[^"]*+)"(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?[[all:other]]
SOURCE_KEY = _raw
WRITE_META = False

Re: listing properties for a pre-trained sourcetype

a212830 — Tue, 01 Jul 2014 21:48:25 GMT

Sooooooooooooo, let's take this to the next step. I am teaching some people how to input data into Splunk. A lot of my requests are syslog, but we don't actually use the syslog sourcetype, because we have so many and want the ability to seperate them. Could I use this command and use the majority of these as a template, to give to my trainees?

Re: listing properties for a pre-trained sourcetype

martin_mueller — Wed, 02 Jul 2014 07:40:13 GMT

Newbies may be confused by this output because it list all the values, including default ones. If you have a sourcetype in props.conf that only has three keys set, btool will still list all of them.
Set the debug flag in btool and you'll see the path for each setting, making it fairly obvious which is default and which isn't.