topic Field extractor warning. in Splunk Search

Field extractor warning.

howyagoin — Mon, 09 May 2011 06:05:11 GMT

Hi,

Lately when I run searches I tend to get a warning on the screen along the lines of:

Field extractor name=access-extractions is unusually slow (max single event time=1140ms, probes=375 warning max=1000ms)

What causes this, and, what should I be looking at to tweak to make Splunk happy again?

Thanks.

Re: Field extractor warning.

hazekamp — Tue, 10 May 2011 20:12:38 GMT

Howyagoin,

This is a warning message introduced in 4.2.1. It will warn when extractions exceed 1000ms. I have browsed limits.conf without finding a setting to increase this threshold; however I would recommend addressing the underlying extraction.

In this case the "access-extractions" transform Regex may need to be adjusted to provide faster matching. This typically involves anchors which will invalidate the match quicker.

Re: Field extractor warning.

howyagoin — Tue, 10 May 2011 20:35:58 GMT

Thanks for this - I spent some time staring at it and came to the same conclusion last night -- I fear what triggered it was a somewhat imprecise search I was conducting which was indeed going through httpd access files which were indexed. I'll have to work on adding sourcetypes to searches a bit more. Thanks!