Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Field Extraction identification
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to determine which field extraction (transforms or search rex) was used for a specific sourcetype?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
by default Splunk provides some basic extractions/transformations on certain sourcetypes. You can find them in
$SPLUNK_HOME/etc/system/default/props.conf
$SPLUNK_HOME/etc/system/default/transforms.conf
If you have not specified any custom sourcetype, you should check there to see if there's already something.
You can eventually apply modification to that sourcetypes and put them in
$SPLUNK_HOME/etc/system/local/props.conf
$SPLUNK_HOME/etc/system/local/transforms.conf
Stefano
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
by default Splunk provides some basic extractions/transformations on certain sourcetypes. You can find them in
$SPLUNK_HOME/etc/system/default/props.conf
$SPLUNK_HOME/etc/system/default/transforms.conf
If you have not specified any custom sourcetype, you should check there to see if there's already something.
You can eventually apply modification to that sourcetypes and put them in
$SPLUNK_HOME/etc/system/local/props.conf
$SPLUNK_HOME/etc/system/local/transforms.conf
Stefano
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
btool looks to be it, will try it out...thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
a quicker way to check that type of mapping is to use btool from CLI.
Also, you can install S.o.S. app and have a way to use btool from UI.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So I guess what you're saying is to go through the props.conf files from different apps and check what configurations are assigned to which sourcetypes?
Is there no way to check that could easily map sourcetype/source/index/etc and props.conf files they are included in? something like.....
SOURCETYPE props location
foo1 $SPLUNK_HOME/etc/apps/app1/local/props.conf
foo2 $SPLUNK_HOME/etc/apps/app2/default/props.conf
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
How to find the worst searches in your Splunk environment and how to fix them
