New to Splunk Enterprise. Confused as to what the best approach for configuring multiple field extractions for a new sourcetype in a multihost deployment. Looking for search time extractions on a log like the one below. We have a deployment server and non-clustered search heads. I can build field extractions using the built in GUI tool but was told I need to migrate these to props/transforms conf files to get them working across my SH deployment. I've read through some these files included in the TAs we've onboarded but not sure I'm following the mapping correct.
What files need what content to get a new key/value pair mapped out?
I can use the built in tool to extract >1 field in the regular expression. Do I break these out or use a consolidated expression?
For search time expressions do I need to deploy the config to any other location other than search heads?
INFO | jvm 3 | 2017/03/12 22:07:13 | ERROR [QueryExecutor[sourcesystem] ] [22:07:13,198]: No historical information could be found for any of the specified paths. Check that paths are correct. Paths: [example/path]
Existing props.conf file put in by PS to handle the wonky jvm log format: