The most common attributes that users will make in props.conf are field extractions. When a user defines an extraction through the web interface, it ends up in props.conf, as shown here:
[my_source_type] EXTRACT-foo = s(?<bar>d+)ms EXTRACT-cat = s(?<dog>d+)s
This configuration defines the fields bar and dog for the my_source_type source type. Extracts are the most common search-time configurations. Any of the stanza types listed in the Stanza types section can be used, but the source type is definitely the most common one.
Other common search-time attributes include:
- REPORT-foo = bar: This attribute is a way to reference stanzas in transforms.conf, but apply them at search time instead of index time. This approach ...
