Splunk Search

export field extraction to resue

rohanmiskin
Explorer

I have extracted two fields in my non prod splunk account. I want to use the same for the prod splunk account as well. The url for prod and non prod are different. I need these fieldextraction in prod before hand, even before the logs start falling into splunk(prod), since my splunk alert is dependent on the logs. Is there a way to export extraction from non prod and import them in prod? 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

There are couple of ways to do it. It depends on your rights and is this OnPrem or Splunk Cloud.

Probably the easiest way is just look via GUI by your self what is the current field extraction definition on test and then just create that again into prod. Maybe not the best way to do it, but probably the easiest.

Another ways needs mode capabilities (power) to do those:

  • Copy those props.conf files from prod to test
  • Create app with those configurations and install it to prod
  • Use REST api to copy + insert it to another environment
  • Use CI/CD with git or some other VCS

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

There are couple of ways to do it. It depends on your rights and is this OnPrem or Splunk Cloud.

Probably the easiest way is just look via GUI by your self what is the current field extraction definition on test and then just create that again into prod. Maybe not the best way to do it, but probably the easiest.

Another ways needs mode capabilities (power) to do those:

  • Copy those props.conf files from prod to test
  • Create app with those configurations and install it to prod
  • Use REST api to copy + insert it to another environment
  • Use CI/CD with git or some other VCS

r. Ismo

0 Karma

rohanmiskin
Explorer

@isoutamo Thanks. As you suggested, I just replicated the transform definition of my fields into prod env, via GUI

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...