This is a weird one. I uploaded some data one time and I set the sourcetype to "MyStuff" and dropped it into my test index.
I search for:
I make a new app in etc/app/MyApp with a props and transforms file.
I go back to my search and enter:
Now I go back to my data and nothing has happened. I don't see my
After banging my head against a wall for a while, I move all my logic into system/local/props.conf and transforms.conf, and re-run my search. All of a sudden my
I have other apps on this box, so I run the btool on my props file to make sure my sourcetype
So how do I go about seeing what exactly is happening to my data when I run that search? It's never making it to my app in etc/app, but the logic works in system/local. Any ideas? I'm about to pull an Office Space on this box.
PS. Yes the permissions are correct on the directory and files.
Fix was to make the app global so the Search App in the GUI could see/use it.
I added the
The file looks like:
Simply, search-time extractions (and other search-time artifacts) are scoped to a specific app unless otherwise specified. Items in system are global. Items in apps can be made global via the GUI and/or the *.meta files (same thing). You can see the effect of which file are running by specifying the app context
answered 22 May '12, 08:20
Sorry if this is a too simple explanation - but you do not make it clear where you put your new props.conf and transforms.conf.
Did you put it in
Also, your regex seems a bit simple, but perhaps this was just for illustration purposes.
answered 22 May '12, 07:41