topic Re: windows 7 issues on configurations in Splunk Search

windows 7 issues on configurations

shariinPH — Fri, 24 Jan 2014 08:25:11 GMT

Hi Splunkers! Is there an issue in making configurations using windows (7) platform. can someone help me in editing configurations especially in auto header.

newbie here.

thanks

Re: windows 7 issues on configurations

martin_mueller — Fri, 24 Jan 2014 09:03:54 GMT

Without any additional info I'm going to guess that your user lacks permissions to edit the .conf file.

Re: windows 7 issues on configurations

shariinPH — Mon, 28 Sep 2020 15:42:47 GMT

hi martin_mueller thanks for reading my question..

im having trouble with auto header extraction using configurations
here is the sample code

props.CONF

[details]
NO_BINARY_CHECK = 1
pulldown_type = 1
REPORT-AutoHeader=extract_details

transforms.CONF

[extract_details]
DELIMS=","
FIELDS="UserName","CaseID","Subject","Action"

I already put the props.CONF and transforms.CONF both on
C:\Program Files\Splunk\etc\system\local

and C:\Program Files\Splunk\etc\apps\myapp\local

I also restarted splunk. Did some reinstallation, still its not working. what do you think is the issue on my configs?