topic Re: Props.conf EXTRACT stopped working after stanza change in Getting Data In

Props.conf EXTRACT stopped working after stanza change

Burritobizon — Fri, 25 May 2018 09:01:36 GMT

Hello!

This morning, i have changed the configuration of an inline extraction in props.conf.
The original Extraction (this worked):

[source::///var/log/containers/*.log]
EXTRACT-sourcedata = (?<containers>(?<=containers\/).*?(?=_)).(?<namespace>.*(?=_)).(?<service>.*(?=-)) in source

I then changed the extraction to this:

[docker_json]
EXTRACT-sourcedata = (?<containers>(?<=containers\/).*?(?=_)).(?<namespace>.*(?=_)).(?<service>.*(?=-)) in source

because the inputs.conf file defines the sourcetype as follows ...

[monitor:///var/log/containers/*.log]
sourcetype = docker_json
disabled = 0

..., this should work.
however, the change did not work. I proceeded to undo said change, yet the old extraction stopped working as well.

Why is that? Does it take time for splunk to apply inline extractions?

Re: Props.conf EXTRACT stopped working after stanza change

Burritobizon — Fri, 25 May 2018 09:33:05 GMT

I have found the answer as to why the old extraction didn't work:

despite that inputs.conf defines the input as follows:

[monitor:///var/log/containers/*.log]

the stanza in props.conf has to be as follows:

[source::/var/log/containers/*.log]

I apologise for above error also being present in the working version above.
However, that does not explain why the new extraction (using the sourcetype) does not work.

Re: Props.conf EXTRACT stopped working after stanza change

FrankVl — Fri, 25 May 2018 11:41:14 GMT

At risk of stating the obvious, but:
- did you deploy the config in the right place (your search head(s))?
- you're not rewriting the sourcetype to something else at index time?
- no conflicting configs due to previous attempts? (e.g. check with btool)