Getting Data In

Creating field extraction

Communicator

I would like to create a new field extraction through props.config for search app.
For example i want to retrieve a custom field called partner whenever i search for events in a source called sexydata and sourcetype = sexuality using the search app.

I created the new field extraction through this REST endpoint.
https://localhost:8089/servicesNS/admin/search/data/props/extractions?name=sexuality&stanza=partner&...?[^:]+)

I don't understand why an HTTP 400 error was thrown when all the GET key=value parameters i appended to the url was thrown and the new field wasn't extracted.

0 Karma

Legend

First of all, I would advise you to start by defining these extractions directly in props.conf first to make sure your extractions are working properly before moving on to trying to set the extractions via the API. It makes troubleshooting easier.

Second, your syntax is wrong. The response body should give you some insight into this. As per the docs that you should have read, you should be giving the parameters as POST data, not GET. http://docs.splunk.com/Documentation/Splunk/4.3.1/RESTAPI/RESTknowledge#POST_data.2Fprops.2Fextracti...

0 Karma

Legend

Yes. You need to make sure to specify which fields you want to be returned in your search request, but the extractions will be persistent, yes.

0 Karma

Communicator

I go check it out.

0 Karma

Communicator

So if i created the new field extractions through the props config file then that means whenever i retrieve the results from the search app via the search/jobs/{search_id}/results REST endpoint i will be able to see the field xml tags with field names extracted as the field attribute k value? Is that true??

0 Karma

Legend
0 Karma

Legend

Under the user you posted the changes as. So for instance if you used the user 'admin', the changes will be found in $SPLUNK_HOME/etc/users/admin/search/local/props.conf.

0 Karma

Communicator

I have done that however i don't see any changes to the props config file for the search app. Where do i see the changes?

0 Karma

Legend

Yes, as POST parameters which indeed are sent in the request body.

0 Karma

Communicator

that means the parameters are sent through HTTP request body?

0 Karma