Splunk Search

index-time extractions

mgherman
Explorer

Hi,

I am trying to configure some index-time field extractions on a SplunkForwarder, so that I can tag all events from the Forwarder with a couple of additional fields.

It is impractical to try to do this at search-time.

I have tried adding the following files to the forwarder, in an attempt to follow the documentation:

  • /opt/splunk/etc/system/local/props.conf

[default]

TRANSFORMS-role = xxx-role

TRANSFORMS-environment = xxx-environment

  • /opt/splunk/etc/system/local/transforms.conf

[xxx-environment]

DEFAULT_VALUE = common

FORMAT = environment::"common"

WRITE_META = true

[xxx-role]

DEFAULT_VALUE = client

FORMAT = role::"client"

WRITE_META = true

  • /opt/splunk/etc/system/local/fields.conf

[role]

INDEXED=true

INDEXED_VALUE=false

[environment]

INDEXED=true

INDEXED_VALUE=false

N.B. The config files look "normal" however I can't manage to format the question.

The only change made to the indexing server has been to add the same fields.conf file.

Having restarted both the forwarder and indexer, I am still unable to search on either "role" or "environment".

(I am trying to search with environment="common" for example.)

Any advice/solution would be greatly appreciated.

Thanks,

mgh

0 Karma

mgherman
Explorer

To answer my own question: adding a regex that matched everything to the transforms.conf has it now working... though I'm sure there must be a better way to do this.

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...