export field extraction to resue

[rohanmiskin]

I have extracted two fields in my non prod splunk account. I want to use the same for the prod splunk account as well. The url for prod and non prod are different. I need these fieldextraction in prod before hand, even before the logs start falling into splunk(prod), since my splunk alert is dependent on the logs. Is there a way to export extraction from non prod and import them in prod? 

[isoutamo · Accepted solution]

There are couple of ways to do it. It depends on your rights and is this OnPrem or Splunk Cloud.

Probably the easiest way is just look via GUI by your self what is the current field extraction definition on test and then just create that again into prod. Maybe not the best way to do it, but probably the easiest.

Another ways needs mode capabilities (power) to do those:

• Copy those props.conf files from prod to test
• Create app with those configurations and install it to prod
• Use REST api to copy + insert it to another environment
• Use CI/CD with git or some other VCS

r. Ismo

[rohanmiskin]

@isoutamo Thanks. As you suggested, I just replicated the transform definition of my fields into prod env, via GUI