Getting Data In

relationship between props.conf and transforms.conf

shangshin
Builder

I added a sourcetype, weblogic_access_log, with its customized field (wl_kv_and_fields
) in props.conf and transforms.conf. If I need to add another sourcetype e.g. tomcat_access_log with a different customized field e.g. tomcat_kv_and_fields. How could I define it in transforms.conf? Hope I am understood. Thanks!

in props.conf

[weblogic_access_log]

REPORT-myfields = wl_kv_and_fields

in transforms.conf

DELIMS = "\t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken
Tags (2)
0 Karma
1 Solution

MatthewTowey
Path Finder

Hi shangshin

In your props.conf file you have "REPORT-myfields = wl_ kv_ and_ fields" so the stanza been referenced in transforms.conf has to be called "wl _kv _and _fields". For example

[wl_ kv_ and_fields]

DELIMS = "t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken

You can reference this stanza for any amount of sources/sourcetypes provided you use the line "REPORT-myfields = wl_ kv_ and_fields"

View solution in original post

0 Karma

MatthewTowey
Path Finder

Hi shangshin

In your props.conf file you have "REPORT-myfields = wl_ kv_ and_ fields" so the stanza been referenced in transforms.conf has to be called "wl _kv _and _fields". For example

[wl_ kv_ and_fields]

DELIMS = "t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken

You can reference this stanza for any amount of sources/sourcetypes provided you use the line "REPORT-myfields = wl_ kv_ and_fields"

0 Karma

shangshin
Builder

good answer. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...