Getting Data In

relationship between props.conf and transforms.conf

shangshin
Builder

I added a sourcetype, weblogic_access_log, with its customized field (wl_kv_and_fields
) in props.conf and transforms.conf. If I need to add another sourcetype e.g. tomcat_access_log with a different customized field e.g. tomcat_kv_and_fields. How could I define it in transforms.conf? Hope I am understood. Thanks!

in props.conf

[weblogic_access_log]

REPORT-myfields = wl_kv_and_fields

in transforms.conf

DELIMS = "\t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken
Tags (2)
0 Karma
1 Solution

MatthewTowey
Path Finder

Hi shangshin

In your props.conf file you have "REPORT-myfields = wl_ kv_ and_ fields" so the stanza been referenced in transforms.conf has to be called "wl _kv _and _fields". For example

[wl_ kv_ and_fields]

DELIMS = "t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken

You can reference this stanza for any amount of sources/sourcetypes provided you use the line "REPORT-myfields = wl_ kv_ and_fields"

View solution in original post

0 Karma

MatthewTowey
Path Finder

Hi shangshin

In your props.conf file you have "REPORT-myfields = wl_ kv_ and_ fields" so the stanza been referenced in transforms.conf has to be called "wl _kv _and _fields". For example

[wl_ kv_ and_fields]

DELIMS = "t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken

You can reference this stanza for any amount of sources/sourcetypes provided you use the line "REPORT-myfields = wl_ kv_ and_fields"

0 Karma

shangshin
Builder

good answer. Thanks!

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...