|
This is a weird one. I uploaded some data one time and I set the sourcetype to "MyStuff" and dropped it into my test index. I search for: I make a new app in etc/app/MyApp with a props and transforms file. In props.conf:
In transforms.conf:
That's it. I go back to my search and enter: Now I go back to my data and nothing has happened. I don't see my After banging my head against a wall for a while, I move all my logic into system/local/props.conf and transforms.conf, and re-run my search. All of a sudden my I have other apps on this box, so I run the btool on my props file to make sure my sourcetype So how do I go about seeing what exactly is happening to my data when I run that search? It's never making it to my app in etc/app, but the logic works in system/local. Any ideas? I'm about to pull an Office Space on this box. PS. Yes the permissions are correct on the directory and files. UPDATE: Fix was to make the app global so the Search App in the GUI could see/use it. I added the The file looks like:
|
|
Simply, search-time extractions (and other search-time artifacts) are scoped to a specific app unless otherwise specified. Items in system are global. Items in apps can be made global via the GUI and/or the *.meta files (same thing). You can see the effect of which file are running by specifying the app context Sorry I'm a complete moron. I was trying to use this app in the search app, but I didn't have my
Once I added that, the app came into scope and worked... Doh!
(23 May '12, 01:11)
bronc
|
|
Sorry if this is a too simple explanation - but you do not make it clear where you put your new props.conf and transforms.conf. Did you put it in Also, your regex seems a bit simple, but perhaps this was just for illustration purposes. Best regards, Kristian |