How to achieve a field extraction in custom sourcetype?

[im_bharath]

Hello All, 

we have a default database:internal sourcetype for a application using DBConnect to send data to Splunk and I want to extract couple of fields from the incoming data from splunk side,

So, I was wondering If I use a custom sourcetype(database:internal:xxxx:zzzz), should I use(extract) the attributes from the data,

"EXTRACT-xxxx = xxxx" in the props.conf or will the intended fields be extracted by default when we change to custom sourcetype?

Any explanation would be really appreciated. 

Thanks. 

[richgalloway]

Why create a custom sourcetype?  Why not just add your EXTRACT settings to the current sourcetype as a local config?  Doing that will get you the intended fields without having to change inputs.conf and everything else that is using the existing sourcetype name.

[im_bharath]

Hey @richgalloway ,

As you suggested, i can add the "Extract" option in the existing default sourcetype(database:internal), but since it is a distributed environment there are multiple apps which have been integrated to Splunk using the DBCONNECT and are using the same default sourcetype, 

So, add the "EXTRACT" attribute will it not affect the other apps ?

Is my understanding correct?

Is there a way that we can apply this EXTRACT attribute for a specific application?

Thanks, 

[richgalloway]

Props.conf settings are specific to a source, sourcetype, or host, but never to an app.

Adding a new field to an existing sourcetype should have little to no negative effect on other users of the sourcetype.