Getting Data In

Creating field extraction

misteryuku
Communicator

I would like to create a new field extraction through props.config for search app.
For example i want to retrieve a custom field called partner whenever i search for events in a source called sexydata and sourcetype = sexuality using the search app.

I created the new field extraction through this REST endpoint.
https://localhost:8089/servicesNS/admin/search/data/props/extractions?name=sexuality&stanza=partner&...?[^:]+)

I don't understand why an HTTP 400 error was thrown when all the GET key=value parameters i appended to the url was thrown and the new field wasn't extracted.

0 Karma

Ayn
Legend

First of all, I would advise you to start by defining these extractions directly in props.conf first to make sure your extractions are working properly before moving on to trying to set the extractions via the API. It makes troubleshooting easier.

Second, your syntax is wrong. The response body should give you some insight into this. As per the docs that you should have read, you should be giving the parameters as POST data, not GET. http://docs.splunk.com/Documentation/Splunk/4.3.1/RESTAPI/RESTknowledge#POST_data.2Fprops.2Fextracti...

0 Karma

Ayn
Legend

Yes. You need to make sure to specify which fields you want to be returned in your search request, but the extractions will be persistent, yes.

0 Karma

misteryuku
Communicator

I go check it out.

0 Karma

misteryuku
Communicator

So if i created the new field extractions through the props config file then that means whenever i retrieve the results from the search app via the search/jobs/{search_id}/results REST endpoint i will be able to see the field xml tags with field names extracted as the field attribute k value? Is that true??

0 Karma

Ayn
Legend
0 Karma

Ayn
Legend

Under the user you posted the changes as. So for instance if you used the user 'admin', the changes will be found in $SPLUNK_HOME/etc/users/admin/search/local/props.conf.

0 Karma

misteryuku
Communicator

I have done that however i don't see any changes to the props config file for the search app. Where do i see the changes?

0 Karma

Ayn
Legend

Yes, as POST parameters which indeed are sent in the request body.

0 Karma

misteryuku
Communicator

that means the parameters are sent through HTTP request body?

0 Karma