Field Extraction identification

[mcm10285]

Is there a way to determine which field extraction (transforms or search rex) was used for a specific sourcetype?

[stefano_guidoba · Accepted solution]

Hi,

by default Splunk provides some basic extractions/transformations on certain sourcetypes. You can find them in

$SPLUNK_HOME/etc/system/default/props.conf
$SPLUNK_HOME/etc/system/default/transforms.conf

If you have not specified any custom sourcetype, you should check there to see if there's already something.
You can eventually apply modification to that sourcetypes and put them in

$SPLUNK_HOME/etc/system/local/props.conf
$SPLUNK_HOME/etc/system/local/transforms.conf

Stefano

[mcm10285]

btool looks to be it, will try it out...thanks!

[stefano_guidoba]

a quicker way to check that type of mapping is to use btool from CLI.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Troubleshooting/Usebtooltotroubleshootconfiguratio...

Also, you can install S.o.S. app and have a way to use btool from UI.

[mcm10285]

So I guess what you're saying is to go through the props.conf files from different apps and check what configurations are assigned to which sourcetypes?

Is there no way to check that could easily map sourcetype/source/index/etc and props.conf files they are included in? something like.....

SOURCETYPE props location
foo1 $SPLUNK_HOME/etc/apps/app1/local/props.conf
foo2 $SPLUNK_HOME/etc/apps/app2/default/props.conf