Creating field extraction

[misteryuku]

I would like to create a new field extraction through props.config for search app.
For example i want to retrieve a custom field called partner whenever i search for events in a source called sexydata and sourcetype = sexuality using the search app.

I created the new field extraction through this REST endpoint.
https://localhost:8089/servicesNS/admin/search/data/props/extractions?name=sexuality&stanza=partner&...?[^:]+)

I don't understand why an HTTP 400 error was thrown when all the GET key=value parameters i appended to the url was thrown and the new field wasn't extracted.

[Ayn]

First of all, I would advise you to start by defining these extractions directly in props.conf first to make sure your extractions are working properly before moving on to trying to set the extractions via the API. It makes troubleshooting easier.

Second, your syntax is wrong. The response body should give you some insight into this. As per the docs that you should have read, you should be giving the parameters as POST data, not GET. http://docs.splunk.com/Documentation/Splunk/4.3.1/RESTAPI/RESTknowledge#POST_data.2Fprops.2Fextracti...

[Ayn]

Yes. You need to make sure to specify which fields you want to be returned in your search request, but the extractions will be persistent, yes.

[misteryuku]

I go check it out.

[misteryuku]

So if i created the new field extractions through the props config file then that means whenever i retrieve the results from the search app via the search/jobs/{search_id}/results REST endpoint i will be able to see the field xml tags with field names extracted as the field attribute k value? Is that true??

[Ayn]

More info available here: http://docs.splunk.com/Documentation/Splunk/4.3.1/RESTAPI/RESTconfigurations

[Ayn]

Under the user you posted the changes as. So for instance if you used the user 'admin', the changes will be found in $SPLUNK_HOME/etc/users/admin/search/local/props.conf.

[misteryuku]

I have done that however i don't see any changes to the props config file for the search app. Where do i see the changes?

[Ayn]

Yes, as POST parameters which indeed are sent in the request body.

[misteryuku]

that means the parameters are sent through HTTP request body?