topic Re: export field extraction to resue in Splunk Search

export field extraction to resue

rohanmiskin — Wed, 10 Nov 2021 06:56:37 GMT

I have extracted two fields in my non prod splunk account. I want to use the same for the prod splunk account as well. The url for prod and non prod are different. I need these fieldextraction in prod before hand, even before the logs start falling into splunk(prod), since my splunk alert is dependent on the logs. Is there a way to export extraction from non prod and import them in prod?

Re: export field extraction to resue

isoutamo — Wed, 10 Nov 2021 09:43:15 GMT

There are couple of ways to do it. It depends on your rights and is this OnPrem or Splunk Cloud.

Probably the easiest way is just look via GUI by your self what is the current field extraction definition on test and then just create that again into prod. Maybe not the best way to do it, but probably the easiest.

Another ways needs mode capabilities (power) to do those:

Copy those props.conf files from prod to test
Create app with those configurations and install it to prod
Use REST api to copy + insert it to another environment
Use CI/CD with git or some other VCS

r. Ismo

Re: export field extraction to resue

rohanmiskin — Wed, 10 Nov 2021 12:40:15 GMT

@isoutamo Thanks. As you suggested, I just replicated the transform definition of my fields into prod env, via GUI