My field extractions are not coming up on splunk.
- i added the extractions in props.conf (tested them b4 adding).
- made a metadata folder and added a file local.meta and added the following lines :-
[default]
export = system
access = read : [ * ], write : [ admin ]
Any idea, what am i missing ?
There is no [default] stanza in local.meta. You'd have to you'd have to create a metadata entry for each EXTRACT/REPORT configuration in your props.conf. Do a restart afterwards.
Ah, yes.
You could try:
[]
export = system
Will make all objects global
Did you restart Splunk?
The props.conf and local.meta. Are they the correct file permissions, i.e can the user Splunk is running as read them?
I'm sure you know this, but make sure you're not searching in Fast mode.. Second, I would first try doing search time extractions to verify it's capturing 100% of your fields. Then when your confident in your regex, put it in props.conf