topic Re: Field extractions are not coming up on splunk. in Getting Data In

Field extractions are not coming up on splunk.

joydeep741 — Wed, 26 Oct 2016 13:54:09 GMT

My field extractions are not coming up on splunk.
- i added the extractions in props.conf (tested them b4 adding).
- made a metadata folder and added a file local.meta and added the following lines :-
[default]
export = system
access = read : [ * ], write : [ admin ]

Any idea, what am i missing ?

Re: Field extractions are not coming up on splunk.

skoelpin — Wed, 26 Oct 2016 13:57:38 GMT

I'm sure you know this, but make sure you're not searching in Fast mode.. Second, I would first try doing search time extractions to verify it's capturing 100% of your fields. Then when your confident in your regex, put it in props.conf

Re: Field extractions are not coming up on splunk.

joydeep741 — Wed, 26 Oct 2016 14:21:41 GMT

tested my regex by using it in the search query.
I am using verbose mode.

Re: Field extractions are not coming up on splunk.

ktugwell_splunk — Wed, 26 Oct 2016 14:29:41 GMT

Did you restart Splunk?

The props.conf and local.meta. Are they the correct file permissions, i.e can the user Splunk is running as read them?

Re: Field extractions are not coming up on splunk.

somesoni2 — Wed, 26 Oct 2016 15:56:26 GMT

There is no [default] stanza in local.meta. You'd have to you'd have to create a metadata entry for each EXTRACT/REPORT configuration in your props.conf. Do a restart afterwards.

Re: Field extractions are not coming up on splunk.

ktugwell_splunk — Wed, 26 Oct 2016 16:00:29 GMT

Ah, yes.

You could try:

[]
export = system

Will make all objects global