topic Re: Extraction Fails on Pooled Search Heads in Splunk Search

Extraction Fails on Pooled Search Heads

tgiles — Wed, 13 Apr 2011 05:14:12 GMT

Hi,

Running into an issue in 4.2 (build 96430) where a field extraction works fine on an indexer, but the exact same extraction fails to run on pooled search heads.

after creating the extraction, I confirmed that the correct regex was listed under Fields > Field Extractions on both search heads.

Performed search and nothing returned. search inspector reports that "This search has completed, but did not match any events."

Forced the search to use the one index that I know there was relevant data, but still nothing returned.

We tested tags and event types without issue- they're both working as expected. Checked the props.conf on the pool and it's getting updated as expected.

Any thoughts on what might be causing the issue?

Thanks

Re: Extraction Fails on Pooled Search Heads

tgiles — Wed, 13 Apr 2011 05:32:25 GMT

Quick note: also tried while logged in as admin user with same results. Thought perhaps it was a permissions issue- looks like that isn't the case.

Re: Extraction Fails on Pooled Search Heads

tgiles — Mon, 18 Apr 2011 16:21:30 GMT

Was able to confirm this is a known issue with 4.2. An update will happen this week sometime to resolve it. Unfortunately, it's not documented on the knownissues for 4.2 quite yet.

Re: Extraction Fails on Pooled Search Heads

tpsplunk — Mon, 03 Oct 2011 19:00:26 GMT

did this ever get fixed?