topic Re: INDEXED_EXTRACTIONS error in splunkd.log in Splunk Search

INDEXED_EXTRACTIONS error in splunkd.log

znaesh — Fri, 06 Jul 2018 13:57:07 GMT

Can you please advise, what do I do if my Splunk complains often (every couple minutes) in splunkd.log in production environment about

07-06-2018 11:21:04.253 +0300 ERROR IndexedExtractionsConfig - Tried to set INDEXED_EXTRACTIONS but it already had a value! (was: 0, wanted: 😎

I have tried enabling debug logging level for IndexedExtractionsConfig, but got no details.
How can I locate and fix the problem?

Re: INDEXED_EXTRACTIONS error in splunkd.log

ddrillic — Fri, 06 Jul 2018 17:49:38 GMT

I see the exact same error at -

But I can't reach this page from Latest Questions on Splunk Answers

Re: INDEXED_EXTRACTIONS error in splunkd.log

znaesh — Sat, 07 Jul 2018 12:39:15 GMT

I am fixing a production Splunk with lots of inputs and users, so I cannot just 'start over' a fresh server and find out when the error would reappear again.
Please advise.
How can I track down the input causing the error?
How can I know what is the impact of the error?
What is the best practice to fix it in a proper way?
What is the meaning of this error at all?

Re: INDEXED_EXTRACTIONS error in splunkd.log

znaesh — Tue, 29 Sep 2020 20:24:40 GMT

Checked that INDEXED_EXTRACTIONS setting is not being redefined several times in any configs.

There are no INDEXED_EXTRACTIONS settings in our server config except for ufix, ufix_status and default config files (unchanged).

ufix and ufix_status events are generated every morning, the should not be causing the minutely error messages.

Re: INDEXED_EXTRACTIONS error in splunkd.log

znaesh — Tue, 29 Sep 2020 20:24:43 GMT

Are our ufix events considered by server to be erroneously indicated as CSV type? Is it a problem caused by unquoted space chars or something?

Sample ufix event:
"/opt/splunk/var/lib/splunk/xru/db/db_1531217904_1531166719_2035/rawdata","journal.gz",10.07.18 13:18 ,453815577,0,6E09087F,3,-

Sample ufix_status event:
List creation: 0, prj creation: 0, report creation: 0

splunk/etc/apps/x/local/props.conf:

[ufix]
DATETIME_CONFIG = CURRENT
FIELD_NAMES = directory, filename, date, byte_length, line_length, crc, crc_type, id_crc
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = CSV-report by ФИКС-Unix
disabled = false
pulldown_type = true

[ufix_status]
category = Structured
pulldown_type = 1
EXTRACT-list_status = List creation: (?\d*), prj
EXTRACT-prj_status = prj creation: (?\d*),
EXTRACT-report_status = report creation: (?\d*)
DATETIME_CONFIG = CURRENT
FIELD_NAMES = directory, filename, modify_date, byte_length, line_length, crc, crc_type, id_crc
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false