topic List of default working extractions in Splunk like "| extract access-extractions" in Splunk Search

List of default working extractions in Splunk like "| extract access-extractions"

Pierceyuk — Wed, 30 Apr 2014 12:27:25 GMT

Hi All,

So I was looking at some unextracted web log data, found this link: http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Extract

Tried the | extract access-extractions
and as if by magic everything gets extracted, is there a document somewhere that gives a list of all of this valid built in extractions that splunk can understand? Having a google and not sure where to look!

Re: List of default working extractions in Splunk like "| extract access-extractions"

richgalloway — Wed, 30 Apr 2014 12:51:59 GMT

Available extractions are in your transforms.conf file. Each stanza name is an extraction.

Re: List of default working extractions in Splunk like "| extract access-extractions"

somesoni2 — Wed, 30 Apr 2014 12:54:17 GMT

For default extractions look for transforms.conf and props.conf file in $Splunk/etc/system/default folder.

Re: List of default working extractions in Splunk like "| extract access-extractions"

Pierceyuk — Wed, 30 Apr 2014 12:56:23 GMT

Thanks Somesoni2, that was exactly what(or rather where) I was looking for!