topic Re: Search Time extraction not working in Splunk Enterprise

Search Time extraction not working

nareshinsvu — Thu, 09 Dec 2021 00:52:46 GMT

Hi,

I am currently working in a new environment where I am trying to do field extraction based of pipe delimiter.

1) A new app (say my_app) with only inputs.conf is pushed onto the target uf through the deployment server.

inputs.conf: [monitor:///path1/file1] index=my_index soyrcetype=my_st

My approach followed

1) Create a new app (plain folder my_app) on my deployer and push it to the search heads with below conf files

I felt it was simple to achieve and did this. somehow it's not working. Did I miss any step to link the app on forwarder and the shc?

ls my_app/default/ app.conf props.conf transforms.conf props.conf [my_st] REPORT-getfields = getfields transforms.conf [getfields] DELIMS = "|" FIELDS = "thread_id","timestamp","loglevel","log_tag","message"

Re: Search Time extraction not working

isoutamo — Thu, 09 Dec 2021 13:54:51 GMT

Are you running SPL on your app (my_app) context or in search app? If you want that those extractions are working somewhere else you must add that information to meta/default.meta inside our app.

And you have done restart or at least reload on SH side after deployment?

Also I think that you are not needing " in a FIELDS as separating field names.

r. Ismo

Re: Search Time extraction not working

PickleRick — Thu, 09 Dec 2021 21:00:10 GMT

Just to make sure - that "soyrcetype" is just a typo on forums, not in your actual config?

Re: Search Time extraction not working

nareshinsvu — Thu, 09 Dec 2021 22:18:33 GMT

Yes, sourcetypes and indexes are just examples in this forum. My config doesnt have typos

Re: Search Time extraction not working

nareshinsvu — Thu, 09 Dec 2021 23:01:29 GMT

@isoutamo - it worked after setting up permissions in default.meta. Thanks for your reply. it worked 🙂