Well done for sticking with it.
Everything looks OK, so my guess would be that whatever you're doing to extract all of your original field names, is being done at 'Search time'. This would mean that they wouldn't be available yet for the EXTRACT commands in props.conf to reference.
No worries, back to basics.
Just extract them all in the sourcetype stanzas. So delete the EXTRACT lines that you have and try this instead:
EXTRACT-full = ^(?<timeStamp>[^,]*),(?<elapsed>[^,]*),"(?<label>[^,]*),(?<ACL>[^"]*)",(?<responseCode>[^,]*),(?<responseMessage>[^,]*),(?:(?<targetHost>[^\s]*)\s(?<JMeterThread>[^,]*))?,(?<dataType>[^,]*),(?<success>[^,]*),(?<failureMessage>[^,]*),(?<bytes>[^,]*),(?<sentBytes>[^,]*),(?<grpThreads>[^,]*),(?<allThreads>[^,]*),(?<Latency>[^,]*),(?<Hostname>[^,]*),(?<IdleTime>[^,]*),(?<Connect>[^$]*)
That should encompass all of your original fields and the 'splits' that you were looking for in your original question.
I'm not sure if there's a way to see, "if the EXTRACTs are loaded by Splunk". But you can use the btool command to see the total configuration that is being applied to a sourcetype.
You need console / command line access, but you could try running:
bin/splunk btool props list Augsburg --debug
This will give you the total config which is being applied to the 'Augsburg' sourcetype/stanza. In a test in my laptop, this gives:
/Applications/Splunk/etc/system/local/props.conf [test-extract]
/Applications/Splunk/etc/system/default/props.conf ANNOTATE_PUNCT = True
/Applications/Splunk/etc/system/default/props.conf AUTO_KV_JSON = true
/Applications/Splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE =
/Applications/Splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE_DATE = True
/Applications/Splunk/etc/system/default/props.conf CHARSET = UTF-8
/Applications/Splunk/etc/system/default/props.conf DATETIME_CONFIG = /etc/datetime.xml
/Applications/Splunk/etc/system/local/props.conf EXTRACT-full = ^(?<timeStamp>[^,]*),(?<elapsed>[^,]*),"(?<label>[^,]*),(?<ACL>[^"]*)",(?<responseCode>[^,]*),(?<responseMessage>[^,]*),(?:(?<targetHost>[^\s]*)\s(?<JMeterThread>[^,]*))?,(?<dataType>[^,]*),(?<success>[^,]*),(?<failureMessage>[^,]*),(?<bytes>[^,]*),(?<sentBytes>[^,]*),(?<grpThreads>[^,]*),(?<allThreads>[^,]*),(?<Latency>[^,]*),(?<Hostname>[^,]*),(?<IdleTime>[^,]*),(?<Connect>[^$]*)
/Applications/Splunk/etc/system/default/props.conf HEADER_MODE =
/Applications/Splunk/etc/system/default/props.conf LEARN_MODEL = true
/Applications/Splunk/etc/system/default/props.conf LEARN_SOURCETYPE = true
/Applications/Splunk/etc/system/default/props.conf LINE_BREAKER_LOOKBEHIND = 100
/Applications/Splunk/etc/system/default/props.conf MATCH_LIMIT = 100000
/Applications/Splunk/etc/system/default/props.conf MAX_DAYS_AGO = 2000
/Applications/Splunk/etc/system/default/props.conf MAX_DAYS_HENCE = 2
/Applications/Splunk/etc/system/default/props.conf MAX_DIFF_SECS_AGO = 3600
/Applications/Splunk/etc/system/default/props.conf MAX_DIFF_SECS_HENCE = 604800
/Applications/Splunk/etc/system/default/props.conf MAX_EVENTS = 256
/Applications/Splunk/etc/system/default/props.conf MAX_TIMESTAMP_LOOKAHEAD = 128
/Applications/Splunk/etc/system/default/props.conf MUST_BREAK_AFTER =
/Applications/Splunk/etc/system/default/props.conf MUST_NOT_BREAK_AFTER =
/Applications/Splunk/etc/system/default/props.conf MUST_NOT_BREAK_BEFORE =
/Applications/Splunk/etc/system/default/props.conf SEGMENTATION = indexing
/Applications/Splunk/etc/system/default/props.conf SEGMENTATION-all = full
/Applications/Splunk/etc/system/default/props.conf SEGMENTATION-inner = inner
/Applications/Splunk/etc/system/default/props.conf SEGMENTATION-outer = outer
/Applications/Splunk/etc/system/default/props.conf SEGMENTATION-raw = none
/Applications/Splunk/etc/system/default/props.conf SEGMENTATION-standard = standard
/Applications/Splunk/etc/system/default/props.conf SHOULD_LINEMERGE = True
/Applications/Splunk/etc/system/default/props.conf TRANSFORMS =
/Applications/Splunk/etc/system/default/props.conf TRUNCATE = 10000
/Applications/Splunk/etc/system/default/props.conf detect_trailing_nulls = false
/Applications/Splunk/etc/system/default/props.conf maxDist = 100
/Applications/Splunk/etc/system/default/props.conf priority =
/Applications/Splunk/etc/system/default/props.conf sourcetype =
The useful thing about this is you can see which configuration file the config is coming from.
Splunk's config system is a layered approach, and sometimes is tricky to see what's coming from where.
Have a go with the EXTRACT above, but also try btool for yourself to see if there's some other configuration being picked up.
... View more