Summarizing comments into answer. To create props configuration using REST API , below parameter require. name - User friendly name of the stanza. stanza - Here you can define stanza based on host, source or sourcetype. For host, stanza will be stanza="host::yourhostname , for source stanza will be stanza="source::yoursource" and for sourcetype you do not need to provide any prefix so stanza will be stanza=yoursourcetype type - Depend on your requirement, if you want to use transforms.conf then specify REPORT or if you want to use Inline regex then specify EXTRACT value - For Inline REGEX (Aka EXTRACT) provide your regular expression for example : "value=^(?:[^\h]*[\h]){2}(?<image>[^\v]*)$" or if you want to use transforms (Aka REPORT) then provide comma or space delimited transforms list. For example: I have raw data This is myimage with sourcetype mysourcetype and I want to extract myimage word from raw data in image field then we can use below curl to fire POST REST API, below curl command will create Private Field Extractions in search app and owner will be admin user. curl -vk -u admin:pass https://localhost:8089/servicesNS/admin/search/data/props/extractions -d name=test -d stanza=mysourcetype -d type=EXTRACT -d "value=^(?:[^\h]*[\h]){2}(?<image>[^\v]*)$" ... View more