Hi folks,
I've been trying to get the CEF 'extension-fields' that are space delimited, after the CEF pipes, to parse correctly during search time. I'm a bit fuzzy on how to tell Splunk to apply it to specific indexes/sourcetypes.
I have my Splunk platform split on 3 servers. I can see the inputs.conf on the Universal Forwarded server. Do I edit the props.conf stanzas for my index/sourcetype on that server? Or do I put it somewhere else? Like on the search server?
I figured it out, and it was easy.
Since I want these to happen during search time, I simply put the example code provided by the author onto the search /local/props.conf
Since I only want this applied during search, not index, this is the only place it is needed.
I figured it out, and it was easy.
Since I want these to happen during search time, I simply put the example code provided by the author onto the search /local/props.conf
Since I only want this applied during search, not index, this is the only place it is needed.