Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Field Extraction identification
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to determine which field extraction (transforms or search rex) was used for a specific sourcetype?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
by default Splunk provides some basic extractions/transformations on certain sourcetypes. You can find them in
$SPLUNK_HOME/etc/system/default/props.conf
$SPLUNK_HOME/etc/system/default/transforms.conf
If you have not specified any custom sourcetype, you should check there to see if there's already something.
You can eventually apply modification to that sourcetypes and put them in
$SPLUNK_HOME/etc/system/local/props.conf
$SPLUNK_HOME/etc/system/local/transforms.conf
Stefano
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
by default Splunk provides some basic extractions/transformations on certain sourcetypes. You can find them in
$SPLUNK_HOME/etc/system/default/props.conf
$SPLUNK_HOME/etc/system/default/transforms.conf
If you have not specified any custom sourcetype, you should check there to see if there's already something.
You can eventually apply modification to that sourcetypes and put them in
$SPLUNK_HOME/etc/system/local/props.conf
$SPLUNK_HOME/etc/system/local/transforms.conf
Stefano
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
btool looks to be it, will try it out...thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
a quicker way to check that type of mapping is to use btool from CLI.
Also, you can install S.o.S. app and have a way to use btool from UI.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So I guess what you're saying is to go through the props.conf files from different apps and check what configurations are assigned to which sourcetypes?
Is there no way to check that could easily map sourcetype/source/index/etc and props.conf files they are included in? something like.....
SOURCETYPE props location
foo1 $SPLUNK_HOME/etc/apps/app1/local/props.conf
foo2 $SPLUNK_HOME/etc/apps/app2/default/props.conf
[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...
