Implementing Splunk 7, Third Edition - Third Edition

Search-time attributes

The most common attributes that users will make in props.conf are field extractions. When a user defines an extraction through the web interface, it ends up in props.conf, as shown here:

[my_source_type] 
EXTRACT-foo = s(?<bar>d+)ms 
EXTRACT-cat = s(?<dog>d+)s 

This configuration defines the fields bar and dog for the my_source_type source type. Extracts are the most common search-time configurations. Any of the stanza types listed in the Stanza types section can be used, but the source type is definitely the most common one.

Other common search-time attributes include:

• REPORT-foo = bar: This attribute is a way to reference stanzas in transforms.conf, but apply them at search time instead of index time. This approach ...