I have certain logs which are indexed correctly. Field extraction using props.conf and transforms.conf works correctly when I am searching within the indexer. However, when I am copying the same set of props and transforms file to the search head, field extraction does not work.
I have put props and transforms under .../ets/apps/search/local in the search head and trying to search within the apps search. Looks like seems something else is taking precedence.
I am just searching:
There is only one type of data in that index.
My question is, is there a way to find which props and/or transforms file applied to a specific sourcetype?
The btool invocation you've used is focused only upon the contents of the "search" app. There are some default behaviors that may be shining through from the base package install. Let me instead suggest splunk cmd btool props list sc --debug. This says "show me the (merged) contents of 'props(.conf)' for stanzas (sourcetypes) starting with 'sc' and show me exactly where the config came from."