extraction fields

[ryastrebov]

Hello splunkers!

I create sourcetype and I extract some fields by Field Extraction menu. I copy the props.conf file to other splunk computer. I discover that n this computer, got my sourcetype. However props.conf file does not contain of my field extractions. How do I transfer my field extractions on other computer?

Thanks!

[kristian_kolb · Accepted solution]

Depending on how you performed your field extractions, the actual configuration may end up in different props.conf files. You should look through your various props.conf files on the first computer and copy the relevant piece of the file to the new splunk installation.

Typically, updating props.conf files is a context sensitive operation, when done through the GUI. I.e. if you are using the (default) Search app, click 'Manager' and perform some config, the changes will be found in /opt/splunk/etc/apps/search/local/props.conf.

Thus, you should look through your file system under /opt/splunk/etc/ for props.conf files and find the one containing your configuration and just copy that part.

For more information, see;

http://docs.splunk.com/Documentation/Splunk/latest/admin/Aboutconfigurationfiles

hope this helps,

K

[ryastrebov]

Thank you! I find necessary props.conf file.