Getting Data In
Highlighted

Creating field extraction

Communicator

I would like to create a new field extraction through props.config for search app.
For example i want to retrieve a custom field called partner whenever i search for events in a source called sexydata and sourcetype = sexuality using the search app.

I created the new field extraction through this REST endpoint.
https://localhost:8089/servicesNS/admin/search/data/props/extractions?name=sexuality&stanza=partner&...?[^:]+)

I don't understand why an HTTP 400 error was thrown when all the GET key=value parameters i appended to the url was thrown and the new field wasn't extracted.

0 Karma
Highlighted

Re: Creating field extraction

Legend

First of all, I would advise you to start by defining these extractions directly in props.conf first to make sure your extractions are working properly before moving on to trying to set the extractions via the API. It makes troubleshooting easier.

Second, your syntax is wrong. The response body should give you some insight into this. As per the docs that you should have read, you should be giving the parameters as POST data, not GET. http://docs.splunk.com/Documentation/Splunk/4.3.1/RESTAPI/RESTknowledge#POST_data.2Fprops.2Fextracti...

0 Karma
Highlighted

Re: Creating field extraction

Communicator

that means the parameters are sent through HTTP request body?

0 Karma
Highlighted

Re: Creating field extraction

Legend

Yes, as POST parameters which indeed are sent in the request body.

0 Karma
Highlighted

Re: Creating field extraction

Communicator

I have done that however i don't see any changes to the props config file for the search app. Where do i see the changes?

0 Karma
Highlighted

Re: Creating field extraction

Legend

Under the user you posted the changes as. So for instance if you used the user 'admin', the changes will be found in $SPLUNK_HOME/etc/users/admin/search/local/props.conf.

0 Karma
Highlighted

Re: Creating field extraction

Legend
0 Karma
Highlighted

Re: Creating field extraction

Communicator

So if i created the new field extractions through the props config file then that means whenever i retrieve the results from the search app via the search/jobs/{search_id}/results REST endpoint i will be able to see the field xml tags with field names extracted as the field attribute k value? Is that true??

0 Karma
Highlighted

Re: Creating field extraction

Communicator

I go check it out.

0 Karma
Highlighted

Re: Creating field extraction

Legend

Yes. You need to make sure to specify which fields you want to be returned in your search request, but the extractions will be persistent, yes.

0 Karma