Knowledge Management

Is there a definitive rule on props.conf order of operation and syntax?

paras
Explorer

Hello,

I wanted to know if there is a definitive rule on how to structure a props.conf. 

I read the docs and it does not say anything about a preference of where to call what operation. I understand the search time operation order form Extract -> Report -> Eval -> FieldAlias -> Lookup.

My question is within a stanz does all the extract have to happen at the top, then the Reports, then the Eval

Ex:

FIELDALIAS-src_ip = srcip ASNEW src_ip
FIELDALIAS-dest_ip = dstip ASNEW dest_ip
FIELDALIAS-src_port = sport ASNEW src_port
FIELDALIAS-dest_port = dport ASNEW dest_port
FIELDALIAS-authentication_protocol = protocol ASNEW authentication_protocol
 
 
FIELDALIAS-src_ip = srcip ASNEW src_ip
FIELDALIAS-dest_ip = dstip ASNEW dest_ip
FIELDALIAS-src_port = sport ASNEW src_port
FIELDALIAS-dest_port = dport ASNEW dest_port
 
 
 
Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The order of settings within a stanza doesn't matter.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @paras,

as @richgalloway said, there's no order in props.conf options because props.conf is a conf file and not a workflow, the only relevant order is that an option is always related to the stanza where it's located.

Why are you seeing datamodels' fields definition?

Datamodels' field definition is managed by GUi and you don't need to manually modify.

Ciao.

Giuseppe

richgalloway
SplunkTrust
SplunkTrust

The order of settings within a stanza doesn't matter.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...