I've updated the props in on a 6.1 server. Checked with btool
which claims my configs are acceptable.
I've also checked btool props
and see the updated REPORT-access
as well as EVAL-some_name
.
I tried loading /debug/refresh
which does show Refreshing admin/transforms-extract OK
But when loading a few lines from the logs, I don't see any fields which I added. Neither the ones from a new REPORT
, nor the one from EVAL
. Everything looks just like it did before.
What else am I missing? Is there something else I can try to debug?
Are you certain that the data has the same sourcetype as you specified in props.conf and transforms.conf? Might you have a typo in one or more of these files? btool is great, but it only checks syntax. btool can't test the actual formatting or regular expressions since it only looks at the configuration files, not the data.
If these hints don't help, please post the relevant stanzas from props.conf and transforms.conf. A little sample data (properly anonymized of course) would also be useful to help the community answer your question.
I've got a host which adds the processing time to the end of nginx log line. This looks like the following:
client_ip - - [03/Mar/2017:09:54:56 +1100] "GET /some/path HTTP/1.1" 200 233474 "https://some/referer" "useragent" "cookies" "0.662"
This normally gets parsed by access_combined_wcookie
, but sticks "0.662" into "other" field. I want to create a req_duration
, so I added apps/marketplace/default/props.conf
:
[access_combined_wcookie]
[source::/var/log/marketplace/nginx-access.log]
REPORT-access = access-extractions-marketplace
and apps/marketplace/default/transforms.conf
:
[access-extractions-marketplace]
# based on system access-extractions, but with extra req_duration at the end
REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[access-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?<referer>[[bc_domain:referer_]]?+[^"]*+)"(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?\s++"[[float:req_duration]]"[[all:other]]
The search results are not changed however. All looks the same after reloads.
have you restarted splunk since changing the .confs??
@DalJeanis no, according to the docs, the reload should be enough to do this.