Splunk Search

Field extraction not working (props.conf)

pal_sumit1
Path Finder

I have one props placed in location , opt splunk etc apps appname local props Below is the code

 [db_accounts]
         DATETIME_CONFIG =
        EXTRACT-AUTHID = \s+(?<AUTHID>[A-Za-z]\w+)(,|\n)
        EVAL-sourcetype = if(source like "%rgn%","db_log_summaries",sourcetype)
        EXTRACT-PRIM_ID,CORR_ID,DATE,TIME,TABLE,DBASE,TBLSPACE,UPS,DES,NS = (?<PRIM_ID>\w+)\s+(?<CORR_ID>(\W\w+|\w+))\s+(?<DATE>\d{4}-\d{2}-\d{2})\s+(?<TIME>[^\s]+)\s+(?<TABLE>[^\s]+)\s+(?<DBASE>[^\s]+)\s+(?<TBLSPACE>[^\s]+)\s+(?<UPS>[^\s]+)\s+(?<DES>[^\s]+)\s+(?<NS>[^\s]+)
        EXTRACT-TextFile = ((?=rgn|admini)(?<TextFile>.*)) in source
        LINE_BREAKER = ([\r\n]+)
        NO_BINARY_CHECK = true
        SHOULD_LINEMERGE = false
        TRANSFORMS-null = eliminate_header1
        category = Custom
        disabled = false

Above props is not extracting the fields at all but If I update the same code in opt splunk etc apps search local props the fields are extracting properly. I am not sure what could be reason for this behavior.

Thanks in advance.

0 Karma

oscar84x
Contributor

Is this a distributed deployment? If so, in what instance(s) are you editing this configuration?
You should run btool when your config is in /opt/splunk/etc/apps/appname/local to see if Splunk is picking it up and troubleshoot from there.

>splunk btool props list --debug
0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...