topic Re: Field Extraction identification in Splunk Search

Field Extraction identification

mcm10285 — Wed, 20 Feb 2013 05:56:20 GMT

Is there a way to determine which field extraction (transforms or search rex) was used for a specific sourcetype?

Re: Field Extraction identification

stefano_guidoba — Mon, 28 Sep 2020 13:21:11 GMT

Hi,

by default Splunk provides some basic extractions/transformations on certain sourcetypes. You can find them in

$SPLUNK_HOME/etc/system/default/props.conf
$SPLUNK_HOME/etc/system/default/transforms.conf

If you have not specified any custom sourcetype, you should check there to see if there's already something.
You can eventually apply modification to that sourcetypes and put them in

$SPLUNK_HOME/etc/system/local/props.conf
$SPLUNK_HOME/etc/system/local/transforms.conf

Stefano

Re: Field Extraction identification

mcm10285 — Mon, 28 Sep 2020 13:21:17 GMT

So I guess what you're saying is to go through the props.conf files from different apps and check what configurations are assigned to which sourcetypes?

Is there no way to check that could easily map sourcetype/source/index/etc and props.conf files they are included in? something like.....

SOURCETYPE props location
foo1 $SPLUNK_HOME/etc/apps/app1/local/props.conf
foo2 $SPLUNK_HOME/etc/apps/app2/default/props.conf

Re: Field Extraction identification

stefano_guidoba — Wed, 20 Feb 2013 10:20:01 GMT

a quicker way to check that type of mapping is to use btool from CLI.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Troubleshooting/Usebtooltotroubleshootconfigurations

Also, you can install S.o.S. app and have a way to use btool from UI.

Re: Field Extraction identification

mcm10285 — Wed, 20 Feb 2013 10:32:47 GMT

btool looks to be it, will try it out...thanks!