topic Re: Override default INDEXED_EXTRACTIONS in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-override-default-for-INDEXED-EXTRACTIONS/m-p/586463#M103102 <P>Just hit this issue, did you find a solution?</P> Thu, 24 Feb 2022 17:55:46 GMT dbot2001 2022-02-24T17:55:46Z How to override default for INDEXED_EXTRACTIONS? https://community.splunk.com/t5/Getting-Data-In/How-to-override-default-for-INDEXED-EXTRACTIONS/m-p/513645#M87094 <P>According to documentation here, under the title "Clear a setting":<BR /><A href="https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Howtoeditaconfigurationfile" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Howtoeditaconfigurationfile</A></P> <P><BR />A configuration setting that appears in default can be overridden by an empty setting in local. This often works for things like FIELDALIAS, EVAL, EXTRACT, REPORT and others except I notice it does NOT work for the INDEXED_EXTRACTIONS setting. It looks like the routine that validates this setting will choke if one of the known-good values is not present. So then, if a vendor set INDEXED_EXTRACTIONS=json in their add-on, I might try and set INDEXED_EXTRACTIONS= in the local/props.conf for that same sourcetype, hoping to instead do my JSON on a select few json nodes.</P> <P>If I did try that, and as Splunk has documented it, then I would find the file would no longer be read in at all. Instead I'd find the following in splunkd.log:<BR /><BR />ERROR IndexedExtractionsConfig - Invalid value=''&nbsp; for parameter='INDEXED_EXTRACTIONS'.</P> <P>and that would be followed by:</P> <P>ERROR TailReader - Ignoring path="/myvendorApp/logs/filename.log" due to: Invalid indexed extractions configuration - see prior error messages</P> <P>If anyone knows how to make this work for INDEXED_EXTRACTIONS, please let me know.</P> Thu, 24 Feb 2022 18:45:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-override-default-for-INDEXED-EXTRACTIONS/m-p/513645#M87094 lumpymilk 2022-02-24T18:45:47Z Re: Override default INDEXED_EXTRACTIONS https://community.splunk.com/t5/Getting-Data-In/How-to-override-default-for-INDEXED-EXTRACTIONS/m-p/513646#M87095 <P>what's your props.conf?</P> Tue, 11 Aug 2020 23:47:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-override-default-for-INDEXED-EXTRACTIONS/m-p/513646#M87095 to4kawa 2020-08-11T23:47:25Z Re: Override default INDEXED_EXTRACTIONS https://community.splunk.com/t5/Getting-Data-In/How-to-override-default-for-INDEXED-EXTRACTIONS/m-p/586463#M103102 <P>Just hit this issue, did you find a solution?</P> Thu, 24 Feb 2022 17:55:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-override-default-for-INDEXED-EXTRACTIONS/m-p/586463#M103102 dbot2001 2022-02-24T17:55:46Z Re: How to override default for INDEXED_EXTRACTIONS? https://community.splunk.com/t5/Getting-Data-In/How-to-override-default-for-INDEXED-EXTRACTIONS/m-p/697656#M115716 <P>Anyone who comes across this issue please upvote the following idea for a configuration option to disable INDEXED_EXTRACTIONS via an app's local props.conf.&nbsp;&nbsp;<BR /><BR /><A href="https://ideas.splunk.com/ideas/EID-I-2400" target="_blank">https://ideas.splunk.com/ideas/EID-I-2400</A></P> Thu, 29 Aug 2024 00:43:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-override-default-for-INDEXED-EXTRACTIONS/m-p/697656#M115716 yeahnah 2024-08-29T00:43:03Z