Alternatives to the way TA parses the data ?

[neerajs_81]

Hi All, 
What are our options if we are not content with the way a TA extracts fields out of our raw data ?  We  are seeing issues with the way AWS Add-on extracts the values for one of the log sources from AWS .  We are using the latest version of their TA as well.   What can we do from our side to correct the field extractions  ?   AWS Data comes in JSON format and one of the fields is messed up.

[richgalloway]

TAs can be modified to suit your needs.  Copy the offending extraction to the TA's local directory and change it as necessary.  Then restart Splunk for it to take effect.

Be aware that doing this means you own that extraction.  If the TA updates it in the future the new extraction will not apply because of the local override.  You can, of course, delete the local version if it's no longer needed.

[neerajs_81]

Do you mean copy the stanzas from props.conf or transform.conf of the TA and then create another copy in /local folder that suits our needs?

[richgalloway · Accepted solution]

Yes.  You'll have the original props.conf and transforms.conf in /default and your changes will be in /local.  The files in /local should contain only the stanza name(s) and the settings you're changing.  No need to replicate the entire file or stanza.