Hi All,
how can i know whether props has been defined to particular sourcetype.
how can i check it.
There are a couple of REST commands you can try
| rest /servicesNS/-/-/configs/conf-props | search sourcetype=foo
If the sourcetype defines field extractions then try
| rest /servicesNS/-/-/data/props/extractions | search stanza=foo
Go to Settings->Source types and search for the expected sourcetype. If it's there then props are defined.
Hi @richgalloway , i could not see any option with name source type under settings.
Then you don't have the proper permissions. You'll have to ask an admin to check for you. There are other methods, but they also require higher permissions.
HI @richgalloway okay, but can you please tell me what are the other methods tocheck.
There are a couple of REST commands you can try
| rest /servicesNS/-/-/configs/conf-props | search sourcetype=foo
If the sourcetype defines field extractions then try
| rest /servicesNS/-/-/data/props/extractions | search stanza=foo