Splunk Search

regex for Apps

fuster_j
Path Finder

I'm looking for the regex for extracted fields in a custom built app. I cannot find them in any props.conf and transforms.conf. Are they stored in different location for Apps?

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

Depending on how the app is built they could also be stored as rex statements inside saved searches used by the app. If you wrote the app, you would probably know that already 🙂

Kristian

0 Karma

Ayn
Legend

No, they go in props.conf / transforms.conf in either the app's default or local directory.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...