Knowledge Management

Is there a definitive rule on props.conf order of operation and syntax?

paras
Explorer

Hello,

I wanted to know if there is a definitive rule on how to structure a props.conf. 

I read the docs and it does not say anything about a preference of where to call what operation. I understand the search time operation order form Extract -> Report -> Eval -> FieldAlias -> Lookup.

My question is within a stanz does all the extract have to happen at the top, then the Reports, then the Eval

Ex:

FIELDALIAS-src_ip = srcip ASNEW src_ip
FIELDALIAS-dest_ip = dstip ASNEW dest_ip
FIELDALIAS-src_port = sport ASNEW src_port
FIELDALIAS-dest_port = dport ASNEW dest_port
FIELDALIAS-authentication_protocol = protocol ASNEW authentication_protocol
 
 
FIELDALIAS-src_ip = srcip ASNEW src_ip
FIELDALIAS-dest_ip = dstip ASNEW dest_ip
FIELDALIAS-src_port = sport ASNEW src_port
FIELDALIAS-dest_port = dport ASNEW dest_port
 
 
 
Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The order of settings within a stanza doesn't matter.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @paras,

as @richgalloway said, there's no order in props.conf options because props.conf is a conf file and not a workflow, the only relevant order is that an option is always related to the stanza where it's located.

Why are you seeing datamodels' fields definition?

Datamodels' field definition is managed by GUi and you don't need to manually modify.

Ciao.

Giuseppe

richgalloway
SplunkTrust
SplunkTrust

The order of settings within a stanza doesn't matter.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...