Getting Data In

Field extractions are not coming up on splunk.

joydeep741
Path Finder

My field extractions are not coming up on splunk.
- i added the extractions in props.conf (tested them b4 adding).
- made a metadata folder and added a file local.meta and added the following lines :-
[default]
export = system
access = read : [ * ], write : [ admin ]

Any idea, what am i missing ?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

There is no [default] stanza in local.meta. You'd have to you'd have to create a metadata entry for each EXTRACT/REPORT configuration in your props.conf. Do a restart afterwards.

0 Karma

ktugwell_splunk
Splunk Employee
Splunk Employee

Ah, yes.

You could try:

[]
export = system

Will make all objects global

0 Karma

ktugwell_splunk
Splunk Employee
Splunk Employee

Did you restart Splunk?

The props.conf and local.meta. Are they the correct file permissions, i.e can the user Splunk is running as read them?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I'm sure you know this, but make sure you're not searching in Fast mode.. Second, I would first try doing search time extractions to verify it's capturing 100% of your fields. Then when your confident in your regex, put it in props.conf

0 Karma

joydeep741
Path Finder
  • tested my regex by using it in the search query.
  • I am using verbose mode.
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...