Getting Data In

Getting a list of field extractions using the API

joemaz95
Path Finder

There are 2 endpoints that seem to return extractions which are data/transforms/extractions and data/props/extractions. I've created some extractions that don't appear in the list when I hit these endpoints. I can only get an extraction in the list by setting the "Apply to" field to host from the dropdown in the UI. Does anyone have any insight as to why the extraction has to be applied to a host for it to show up in endpoint output?

0 Karma

jawaharas
Motivator

The field extraction entity should be tagged (applied) to sourcetype, host or source. It's required field.

field extractions snapshot

0 Karma

joemaz95
Path Finder

Right! I'm trying to get a list of every field extraction, but only extractions tagged with "host" are returned.

0 Karma

jawaharas
Motivator

It should be there. I tried to search an field extraction which is tagged to a sourcetype and the REST API returns result.

| rest /services/data/props/extractions
| search title="<NAME_OF_YOUR_FIELD_EXTRACTON>"
0 Karma

jawaharas
Motivator

@joemaz95
Kindly accept the answer if it helped you.

0 Karma

joemaz95
Path Finder

Unfortunately, the extractions in question still don't appear when hitting that endpoint.

0 Karma

woodcock
Esteemed Legend

Try these (it is probably in a different app that you think):

|rest/servicesNS/-/-/data/transforms/extractions
|rest/servicesNS/-/-/data/props/extractions

joemaz95
Path Finder

Thanks for the response, this didn't appear to resolve the issue.

0 Karma

woodcock
Esteemed Legend

How can anybody help you without more detail? The answer that I provided absolutely works unless you do not have privilege/permission to access the endpoint, which is probably the case.

0 Karma

jawaharas
Motivator

May I know in which screen you see 'Apply to' option?

" I can only get an extraction in the list by setting the "Apply to" field to host from the dropdown in the UI"

0 Karma

joemaz95
Path Finder

Thanks for helping me clarify. The field in question is found here:
Settings Dropdown > Fields > Field Extractions > New Field Extraction > Apply to _____ named _____

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...