Splunk Search

How to turn search '... | extract access-extractions' into a props.conf file?

Pierceyuk
Path Finder

Hey All,

So i have some web logs, lets call them source type 'webbylogs'.
If I search 'sourcetype=webbylogs | extract access-extractions' then everything gets extracted and all the fields are there and its all amazing.

How can I make this work in a props.conf?
I tried:

props.conf
[webbylogs]
REPORT-webbylogs = access-extractions
LOOKUP-IPlookup = lookup src_ip OUTPUT is_internal

As I have a lookup I want to work after this. But nothing happens. I pushed this to my search head, should it be indexer?

Am I missing something obvious?

Tags (3)
0 Karma
1 Solution

Pierceyuk
Path Finder

The issue was that the source type was actually webbyLogs with a capital L. and in the props file I had it all in lower case (like every other sourcetype).

thanks to MuS for all your pointers and help

View solution in original post

0 Karma

Pierceyuk
Path Finder

The issue was that the source type was actually webbyLogs with a capital L. and in the props file I had it all in lower case (like every other sourcetype).

thanks to MuS for all your pointers and help

0 Karma

MuS
Legend

Hi Pierceyuk,

do you have a access-extractions stanza in your transforms.conf? see docs http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Managesearch-timefieldextractions

Also check out this awesome wiki page http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings where you can see that this should be placed on the search head.

cheers, MuS

MuS
Legend

You can use the btool to check if there is any mismatch for props and/or transforms over all apps like this:

splunk cmd btool --debug props list
splunk cmd btool --debug transforms list

Also the copy approach is good for try&error it will do no harm.

Pierceyuk
Path Finder

the access-extractions is a built in extraction located in /opt/splunk/etc/system/default/transforms.conf Do you think I should just copy the code out and put it in a transforms.conf in this little extraction app?

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...