Does ES use the same props and transforms as core SPLUNK

[pfabrizi]

I have the following field alias and extractions in my props.conf, however they only see to work when searching from core splunk and NOT ES even though same SH device.

FIELDALIAS-severity_as_id = severity as severity_id
FIELDALIAS-dst_as_dest = dst as dest
EVAL-app = netwitness
EVAL-analysis_session = split(analysis_session, ",")
EVAL-analysis_service = split(analysis_service, ",")
EVAL-analysis_file = split(analysis_file, ",")
EVAL-action = split(action, ",")
EVAL-content = split(content, ",")
EVAL-extension = split(extension, ",")
EVAL-filetypee = split(filetype, ",")
EVAL-fname = split(fname, ",")

Do I have to add them to Props.conf in ES?

Thanks!

[esix_splunk · Accepted solution]

ES uses the same underlying Knowledge Objects as Splunk Enterprise (CORE.) You do need to be aware of how ES will import existing knowledge objects, it looks for a defined name space for importing...

This page here describes how to update the inputs in ES 5.0+ -- https://docs.splunk.com/Documentation/ES/5.0.0/Install/ImportCustomApps

Its worth noting that the defaul app import name spaces are :

(appsbrowser)|(search)|([ST]A-.*)|(Splunk_[ST]A_.*)|(DA-ESS-.*)|(Splunk_DA-ESS_.*)

So any KO in those named spaces should be imported successfully. This follows our best practices of putting your extractions and knowledge objects into apps named SA-appname or TA-appname.

You can also use the following REST command to check and see what apps are currently being imported :

|rest services/data/inputs/app_imports_update | table title app_regex app_exclude_regex updated

And again, your APP should be in the import list for it to be visible and in use,

Cheers
Eric

[pfabrizi]

we use a deployment server and created a folder called travlers_all_app_props. This doesn't follow what you recommend as best practice. Does this cause an issue?

I did check the permissions on those extractions, evals and alias and they are set to global.

Thanks!

[pfabrizi]

Thank You, I added that to the ES and it works great.

[esix_splunk]

If you notice, the app called travelers_all_app_props isnt included in the ES App Import Naming Space. So ES will ignore this app, and its knowledge objects.

You either need to follow the docs on how to import the app into ES, or rename it to TA-travelers_all_props

Regarding best practices, this doesnt cause an issue per say, its just that Splunk recommends naming apps in a certain way in order to standardize and make troubleshooting deployments easier.