Field extraction not working (props.conf)

pal_sumit1 — Fri, 29 Nov 2019 09:21:30 GMT

I have one props placed in location , opt splunk etc apps appname local props Below is the code

 [db_accounts]
         DATETIME_CONFIG =
        EXTRACT-AUTHID = \s+(?<AUTHID>[A-Za-z]\w+)(,|\n)
        EVAL-sourcetype = if(source like "%rgn%","db_log_summaries",sourcetype)
        EXTRACT-PRIM_ID,CORR_ID,DATE,TIME,TABLE,DBASE,TBLSPACE,UPS,DES,NS = (?<PRIM_ID>\w+)\s+(?<CORR_ID>(\W\w+|\w+))\s+(?<DATE>\d{4}-\d{2}-\d{2})\s+(?<TIME>[^\s]+)\s+(?<TABLE>[^\s]+)\s+(?<DBASE>[^\s]+)\s+(?<TBLSPACE>[^\s]+)\s+(?<UPS>[^\s]+)\s+(?<DES>[^\s]+)\s+(?<NS>[^\s]+)
        EXTRACT-TextFile = ((?=rgn|admini)(?<TextFile>.*)) in source
        LINE_BREAKER = ([\r\n]+)
        NO_BINARY_CHECK = true
        SHOULD_LINEMERGE = false
        TRANSFORMS-null = eliminate_header1
        category = Custom
        disabled = false

Above props is not extracting the fields at all but If I update the same code in opt splunk etc apps search local props the fields are extracting properly. I am not sure what could be reason for this behavior.

Thanks in advance.

Re: Field extraction not working (props.conf)

oscar84x — Mon, 02 Dec 2019 16:29:10 GMT

Is this a distributed deployment? If so, in what instance(s) are you editing this configuration?
You should run btool when your config is in /opt/splunk/etc/apps/appname/local to see if Splunk is picking it up and troubleshoot from there.

>splunk btool props list --debug

topic Re: Field extraction not working (props.conf) in Splunk Search

Field extraction not working (props.conf)

Re: Field extraction not working (props.conf)