I have one props placed in location , opt splunk etc apps appname local props Below is the code
[db_accounts]
DATETIME_CONFIG =
EXTRACT-AUTHID = \s+(?<AUTHID>[A-Za-z]\w+)(,|\n)
EVAL-sourcetype = if(source like "%rgn%","db_log_summaries",sourcetype)
EXTRACT-PRIM_ID,CORR_ID,DATE,TIME,TABLE,DBASE,TBLSPACE,UPS,DES,NS = (?<PRIM_ID>\w+)\s+(?<CORR_ID>(\W\w+|\w+))\s+(?<DATE>\d{4}-\d{2}-\d{2})\s+(?<TIME>[^\s]+)\s+(?<TABLE>[^\s]+)\s+(?<DBASE>[^\s]+)\s+(?<TBLSPACE>[^\s]+)\s+(?<UPS>[^\s]+)\s+(?<DES>[^\s]+)\s+(?<NS>[^\s]+)
EXTRACT-TextFile = ((?=rgn|admini)(?<TextFile>.*)) in source
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRANSFORMS-null = eliminate_header1
category = Custom
disabled = false
Above props is not extracting the fields at all but If I update the same code in opt splunk etc apps search local props the fields are extracting properly. I am not sure what could be reason for this behavior.
Thanks in advance.
Is this a distributed deployment? If so, in what instance(s) are you editing this configuration?
You should run btool when your config is in /opt/splunk/etc/apps/appname/local to see if Splunk is picking it up and troubleshoot from there.
>splunk btool props list --debug