List of default working extractions in Splunk like "| extract access-extractions"

[Pierceyuk]

Hi All,

So I was looking at some unextracted web log data, found this link: http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Extract

Tried the | extract access-extractions
and as if by magic everything gets extracted, is there a document somewhere that gives a list of all of this valid built in extractions that splunk can understand? Having a google and not sure where to look!

[richgalloway · Accepted solution]

Available extractions are in your transforms.conf file. Each stanza name is an extraction.

[Pierceyuk]

Thanks Somesoni2, that was exactly what(or rather where) I was looking for!

[somesoni2]

For default extractions look for transforms.conf and props.conf file in $Splunk/etc/system/default folder.