Trying to get CEFUtils working, question about where to edit props/transforms

[jravida]

Hi folks,

I've been trying to get the CEF 'extension-fields' that are space delimited, after the CEF pipes, to parse correctly during search time. I'm a bit fuzzy on how to tell Splunk to apply it to specific indexes/sourcetypes.

I have my Splunk platform split on 3 servers. I can see the inputs.conf on the Universal Forwarded server. Do I edit the props.conf stanzas for my index/sourcetype on that server? Or do I put it somewhere else? Like on the search server?

[jravida · Accepted solution]

I figured it out, and it was easy.

Since I want these to happen during search time, I simply put the example code provided by the author onto the search /local/props.conf

Since I only want this applied during search, not index, this is the only place it is needed.