Query to be auto applied

[Karthikeya]

Hello,

We have json data coming in Splunk and to extract that we have given

| rex "(?<json>\{.*\})"

| spath input=json

Now my ask is I want this query to be run by default for one or more sourcetypes, without everytime giving in search query.

Do I need to do it while on boarding itself only? If yes please help me with step by step procedure. We don't have HF. We have deployment server, manager, and 3 indexers. DS will push apps to manager and from there manager will push apps to peers.

[mattymo]

Simplest way to put it...create a single app with all your sourcetype configs in it, then distribute that app using the appropriate mechanism for 1. indexers (manager node) 2. Search heads (deployer for SHC or DS/Directly, if standalone) 

[Karthikeya]

Ok here my doubt is... Can one app which contains props.conf (with kv_mode=json) be distributed to both indexers and search heads? Because will it may lead to duplication of fields or events by any chance? Index time and search time extraction I am asking about. Is it ok?

[gcusello]

Hi @Karthikeya ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[mattymo · Accepted solution]

yes it can. and no it wont. because you wont be extracting fields at index time if you dont use indexed_extractions=json. 

Splunk is very good at applying only what config matters. So when in doubt send them to both idx and sh. Splunk usually just figures it out. 

The duplicate extractions issues happens when you do BOTH index time (indexed_extractions=json) AND Search time (kv_mode=json) in your props.conf config. Thats when they may collide, and is why i say i ALMOST never enable indexed_extractions=json as I would always prefer review of search time extract then only move key fields i need to index time for performance reasons.