Why does Splunk overwrite the 'messages' field in scheduler.log events?

pkeller — Tue, 29 Sep 2020 18:57:40 GMT

It seems that scheduler.log events are all prepared for parsing

04-09-2018 23:35:04.548 +0000 ERROR SavedSplunker - savedsearch_id="nobody;my_lookups;Unix DHCP Refresh", message="Error in 'lookup' command: Lookups: The lookup table 'dhcp_lookup' does not exist or is not available.". No actions executed

Yet, etc/app/search/default/props.conf is insistent on overwriting that so that it extracts EVERYTHING after "SavedSplunker - " into the the 'message' field.

[scheduler]
EXTRACT-fields = (?i)^(?:[^ ]* ){2}(?:[+\-]\d+ )?(?P<log_level>[^ ]*)\s+(?P<component>[^ ]+) - (?P<message>.+)

So, now instead of message being: Error in 'lookup' command: Lookups: The lookup table 'dhcp_lookup' does not exist or is not available

it's expanded to:

savedsearch_id="nobody;my_lookups;Unix DHCP Refresh", message="Error in 'lookup' command: Lookups: The lookup table 'dhcp_lookup' does not exist or is not available.". No actions executed
So the question is, why? And why choose the same fieldname that's already been used in the event itself?

It seems that it would have been much more logical to have chosen a different fieldname than 'message'.

Thank you

Re: Why does Splunk overwrite the 'messages' field in scheduler.log events?

somesoni2 — Thu, 12 Apr 2018 21:58:28 GMT

I don't see that field extraction is version 6.2, so not sure in what version it was introduced. It seems like field extraction for the sourcetype splunkd has been copied there is and it's definitely wrong for sourcetype scheduler. I would raise this a bug.

Re: Why does Splunk overwrite the 'messages' field in scheduler.log events?

pkeller — Fri, 13 Apr 2018 22:56:14 GMT

Thank you I've opened up a ticket on this and have requested that a bug be raised.

Cheers

topic Re: Why does Splunk overwrite the 'messages' field in scheduler.log events? in Getting Data In

Why does Splunk overwrite the 'messages' field in scheduler.log events?

Re: Why does Splunk overwrite the 'messages' field in scheduler.log events?

Re: Why does Splunk overwrite the 'messages' field in scheduler.log events?