topic Re: Why is the global sourcetype defined in props.conf and transforms.conf not used by my custom app? in Getting Data In

Why is the global sourcetype defined in props.conf and transforms.conf not used by my custom app?

faustf — Fri, 17 Feb 2017 09:25:19 GMT

Hi guys

I've defined my sourcetype, transforms and lookup in /opt/splunk/etc/system/local/props.conf and /opt/splunk/etc/system/local/transforms.conf (I set the lookup from the web interface).
Everything is working fine with the default Search and Reporting App.
After I created my customApp and if I perform the same search in the App, I can see the right source_type associated to my data but the regex that I defined in /opt/splunk/etc/system/local/transforms.conf is not applied.

Any suggestion?

Thanks

Re: Why is the global sourcetype defined in props.conf and transforms.conf not used by my custom app?

martin_mueller — Fri, 17 Feb 2017 10:09:18 GMT

Most likely there's some config in the wrong place. Here's a start:

$SPLUNK_HOME/bin/splunk btool props list your_sourcetype --debug
$SPLUNK_HOME/bin/splunk btool transforms list your_transforms_or_lookup --debug

Check if all relevant settings are in the right place from Splunk's point of view. For more detailed help you'll need to share your config.

Re: Why is the global sourcetype defined in props.conf and transforms.conf not used by my custom app?

faustf — Fri, 17 Feb 2017 10:59:41 GMT

Thanks, this helped!

Re: Why is the global sourcetype defined in props.conf and transforms.conf not used by my custom app?

martin_mueller — Fri, 17 Feb 2017 11:40:43 GMT

Feel free to elaborate what you did to fix and mark as accepted.