https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120709#M289 <P>Is this resolved ?</P> Mon, 21 Sep 2015 02:27:41 GMT i2sheri 2015-09-21T02:27:41Z https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120702#M282 <P>Hey Splunkers, </P> <P>I'm getting an error in _internal that I can't seem to figure out. Every enabled app that has a csv lookup is throwing this error in splunkd.log. These happen quite frequently -- adding up to 100,000 a day! <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P>Environmont Details: Splunk 6.1. Enterprise Security 3.1 </P> <PRE><CODE>06-26-2014 04:24:00.807 +0000 WARN TransformsExtractionHandler - Unable to find stanza=identities_expanded.csv in lookups.conf, cannot enumerate fields list 06-26-2014 04:24:00.807 +0000 WARN TransformsExtractionHandler - Unable to find stanza=pci_domains.csv in lookups.conf, cannot enumerate fields list 06-26-2014 04:24:00.807 +0000 WARN TransformsExtractionHandler - Unable to find stanza=pci_domains_from_assets.csv in lookups.conf, cannot enumerate fields list 06-26-2014 04:24:00.807 +0000 WARN TransformsExtractionHandler - Unable to find stanza=assets.csv in lookups.conf, cannot enumerate fields list 06-26-2014 04:24:00.807 +0000 WARN TransformsExtractionHandler - Unable to find stanza=identities.csv in lookups.conf, cannot enumerate fields list </CODE></PRE> <P>Why would Splunk complain about every csv lookup in my environment??? I don't get any syantax errors when I start splunk. Any help would be greatly appreciated. Thanks! </P> Thu, 26 Jun 2014 05:35:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120702#M282 joshuamcqueen 2014-06-26T05:35:14Z https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120703#M283 <P>Its a bug in Splunk. A ticket has been opened for this (ticket number SPL-82145).</P> Thu, 26 Jun 2014 06:15:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120703#M283 LukeMurphey 2014-06-26T06:15:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120704#M284 <P>Thanks or the info. Is this warning harmless? Can it be affecting performance? Is there anyway to suppress?</P> Thu, 26 Jun 2014 14:25:58 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120704#M284 joshuamcqueen 2014-06-26T14:25:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120705#M285 <P>The warning is harmless (except for consuming disk space and I/O when being written). You can suppress it by setting this in log.cfg:</P> <P>category.TransformsExtractionHandler=ERROR</P> <P>However, you'd lose other warning messages from that category via that solution; caveat emptor.</P> Thu, 26 Jun 2014 15:40:10 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120705#M285 jervin_splunk 2014-06-26T15:40:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120706#M286 <P>I have the same problem.<BR /> I've just done this change in log.conf "category.TransformsExtractionHandler=ERROR", but issue is still alive.</P> <P>Any other workaround?</P> Tue, 01 Jul 2014 16:52:32 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120706#M286 antonioformato 2014-07-01T16:52:32Z https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120707#M287 <P>Did you restart Splunk to make the updated log.cfg take effect? I'm not seeing the messages following a restart, but am likely on a different product version.</P> <P>To make the settings take effect immediately, you can also do this:</P> <P>splunk set log-level TransformsExtractionHandler -level ERROR</P> <P>However I don't think that will persist beyond a restart.</P> <P>If you continue to have trouble, I'd suggest opening a support case; there could be other issues at play.</P> Wed, 02 Jul 2014 23:13:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120707#M287 jervin_splunk 2014-07-02T23:13:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120708#M288 <P>added as a known issue for splunk 6.1.*<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/ReleaseNotes/KnownIssues#Search.2C_saved_search.2C_alerting.2C_scheduling.2C_and_job_management_issues">http://docs.splunk.com/Documentation/Splunk/6.1.3/ReleaseNotes/KnownIssues#Search.2C_saved_search.2C_alerting.2C_scheduling.2C_and_job_management_issues</A></P> Fri, 05 Sep 2014 04:11:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120708#M288 yannK 2014-09-05T04:11:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120709#M289 <P>Is this resolved ?</P> Mon, 21 Sep 2015 02:27:41 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/TransformsExtractionHandler-Unable-to-find-stanza-Getting/m-p/120709#M289 i2sheri 2015-09-21T02:27:41Z