Splunk Search

export field extraction to resue

rohanmiskin
Explorer

I have extracted two fields in my non prod splunk account. I want to use the same for the prod splunk account as well. The url for prod and non prod are different. I need these fieldextraction in prod before hand, even before the logs start falling into splunk(prod), since my splunk alert is dependent on the logs. Is there a way to export extraction from non prod and import them in prod? 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

There are couple of ways to do it. It depends on your rights and is this OnPrem or Splunk Cloud.

Probably the easiest way is just look via GUI by your self what is the current field extraction definition on test and then just create that again into prod. Maybe not the best way to do it, but probably the easiest.

Another ways needs mode capabilities (power) to do those:

  • Copy those props.conf files from prod to test
  • Create app with those configurations and install it to prod
  • Use REST api to copy + insert it to another environment
  • Use CI/CD with git or some other VCS

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

There are couple of ways to do it. It depends on your rights and is this OnPrem or Splunk Cloud.

Probably the easiest way is just look via GUI by your self what is the current field extraction definition on test and then just create that again into prod. Maybe not the best way to do it, but probably the easiest.

Another ways needs mode capabilities (power) to do those:

  • Copy those props.conf files from prod to test
  • Create app with those configurations and install it to prod
  • Use REST api to copy + insert it to another environment
  • Use CI/CD with git or some other VCS

r. Ismo

0 Karma

rohanmiskin
Explorer

@isoutamo Thanks. As you suggested, I just replicated the transform definition of my fields into prod env, via GUI

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...