Extracting fields using props.conf and transforms.conf

So far, we have created field aliases, calculated fields, and field extractions using Splunk Web. These changes can also be made using configuration files. Let’s look at the changes in the configuration files that occurred when we created the http_referer and referer_domain fields in the previous section, Extracting fields using the GUI. Use a ssh client to connect to searchhead1 and browse to /opt/splunk/etc/apps/botsv1_data_set/local/props.conf. You should see the following configurations under the [iis] and [suricata] stanzas:

[iis]
FIELDALIAS-http_refer_rename = cs_Referer ASNEW http_referer
EXTRACT-referer_domain = http://(?<referer_domain>(\w+\.\w+|\d+\.\d+\.\d+\.\d+))\/
[suricata]
EVAL-bytes = bytes_in + bytes_out

Since the field alias (http_referer) and the field extraction (referer_domain) are associated with the IIS sourcetype, they are inserted under the [iis] stanza. The calculated field (bytes) was...