Splunk Search

Is it possible to pass variables in props.conf with my current configuration?

ltrand
Contributor

I was wondering if it was possible to write a props.conf something similar to the following:

props:

[sourcetype = masterlog_*]
REPORT-extract-various-fields = masterlog_extractions_$1

and then have transforms like this:

[masterlog_extractions_SomeLog1]
Delims = "\t"
Fields = _time,id,src,dest,count,msg

[masterlog_extractions_SomeLog2]
Delims = "\t"
Fields = _time,sub_id,choice,variable,code,quantity

So the idea is that I don't have to write a props & transform for each sourcetype, that I could have one props point to the correct transform & have it just work? Ultimately this will go on the search head to define the fields and I would like to avoid index time extraction.

0 Karma

Runals
Motivator

So in your props do this

[(?::){0}masterlog_*]
REPORT-extract-various-fields = masterlog_extractions_SomeLog1, masterlog_extractions_SomeLog2
0 Karma

ltrand
Contributor

As an update, I've tried several methods to perform this and it does not look like it is possible. I've attempted calling it as a * and as a $1 and it is not feeding the events through the parser correctly. My next step will be to put splunk into a debug logging mode so that I can see where exactly it hits, but I need to stand up a test search head so I don't have actual users & logs from the other search apps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...