How to turn search '... | extract access-extractions' into a props.conf file?

[Pierceyuk]

Hey All,

So i have some web logs, lets call them source type 'webbylogs'.
If I search 'sourcetype=webbylogs | extract access-extractions' then everything gets extracted and all the fields are there and its all amazing.

How can I make this work in a props.conf?
I tried:

props.conf
[webbylogs]
REPORT-webbylogs = access-extractions
LOOKUP-IPlookup = lookup src_ip OUTPUT is_internal

As I have a lookup I want to work after this. But nothing happens. I pushed this to my search head, should it be indexer?

Am I missing something obvious?

[Pierceyuk · Accepted solution]

The issue was that the source type was actually webbyLogs with a capital L. and in the props file I had it all in lower case (like every other sourcetype).

thanks to MuS for all your pointers and help

[MuS]

Hi Pierceyuk,

do you have a access-extractions stanza in your transforms.conf? see docs http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Managesearch-timefieldextractions

Also check out this awesome wiki page http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings where you can see that this should be placed on the search head.

cheers, MuS

[MuS]

You can use the btool to check if there is any mismatch for props and/or transforms over all apps like this:

splunk cmd btool --debug props list
splunk cmd btool --debug transforms list

Also the copy approach is good for try&error it will do no harm.

[Pierceyuk]

the access-extractions is a built in extraction located in /opt/splunk/etc/system/default/transforms.conf Do you think I should just copy the code out and put it in a transforms.conf in this little extraction app?