topic Re: Is it possible to pass variables in props.conf with my current configuration? in Splunk Search

Is it possible to pass variables in props.conf with my current configuration?

ltrand — Wed, 04 Feb 2015 20:03:42 GMT

I was wondering if it was possible to write a props.conf something similar to the following:

props:

[sourcetype = masterlog_*]
REPORT-extract-various-fields = masterlog_extractions_$1

and then have transforms like this:

[masterlog_extractions_SomeLog1]
Delims = "\t"
Fields = _time,id,src,dest,count,msg

[masterlog_extractions_SomeLog2]
Delims = "\t"
Fields = _time,sub_id,choice,variable,code,quantity

So the idea is that I don't have to write a props & transform for each sourcetype, that I could have one props point to the correct transform & have it just work? Ultimately this will go on the search head to define the fields and I would like to avoid index time extraction.

Re: Is it possible to pass variables in props.conf with my current configuration?

ltrand — Tue, 10 Feb 2015 20:58:05 GMT

As an update, I've tried several methods to perform this and it does not look like it is possible. I've attempted calling it as a * and as a $1 and it is not feeding the events through the parser correctly. My next step will be to put splunk into a debug logging mode so that I can see where exactly it hits, but I need to stand up a test search head so I don't have actual users & logs from the other search apps.

Re: Is it possible to pass variables in props.conf with my current configuration?

Runals — Tue, 10 Feb 2015 21:27:52 GMT

So in your props do this

[(?::){0}masterlog_*]
REPORT-extract-various-fields = masterlog_extractions_SomeLog1, masterlog_extractions_SomeLog2