Splunk Enterprise

Search Time extraction not working

nareshinsvu
Builder

Hi,

 I am currently working in a new environment where I am trying to do field extraction based of pipe delimiter.

1) A new app (say my_app) with only inputs.conf is pushed onto the target uf through the deployment server.

 

 

 

inputs.conf:
[monitor:///path1/file1]
index=my_index
soyrcetype=my_st

 

 

 

2) Data is getting ingested and the requirement is to do field extraction on all the events separated by pipe delimiter (12345|2021-09-12 11:12:34 345|INFO|blah|blah|blah blah)

My approach followed

1) Create a new app (plain folder my_app) on my deployer and push it to the search heads with below conf files

I felt it was simple to achieve and did this. somehow it's not working. Did I miss any step to link the app on forwarder and the shc?

 

 

 

ls my_app/default/
app.conf props.conf transforms.conf

props.conf
[my_st]
REPORT-getfields = getfields

transforms.conf
[getfields]
DELIMS = "|"
FIELDS = "thread_id","timestamp","loglevel","log_tag","message"

 

 

 

 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Are you running SPL on your app (my_app) context or in search app? If you want that those extractions are working somewhere else you must add that information to meta/default.meta inside our app.

And you have done restart or at least reload on SH side after deployment?

Also I think that you are not needing " in a FIELDS as separating field names.

r. Ismo

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Just to make sure - that "soyrcetype" is just a typo on forums, not in your actual config?

0 Karma

nareshinsvu
Builder

Yes, sourcetypes and indexes are just examples in this forum. My config doesnt have typos

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Are you running SPL on your app (my_app) context or in search app? If you want that those extractions are working somewhere else you must add that information to meta/default.meta inside our app.

And you have done restart or at least reload on SH side after deployment?

Also I think that you are not needing " in a FIELDS as separating field names.

r. Ismo

nareshinsvu
Builder

@isoutamo  - it worked after setting up permissions in default.meta. Thanks for your reply. it worked 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...