topic Why does a new field extraction not work on the search head just I created it on, but works immediately on other members in the search head cluster? in Splunk Search

Why does a new field extraction not work on the search head just I created it on, but works immediately on other members in the search head cluster?

BP9906 — Tue, 24 Mar 2015 21:28:18 GMT

Running the latest Splunk 6.2.2 with search head clustering. I found that when I create a new search field extraction, it doesnt immediately start to work on the current search head that I'm on. It will start working on the other cluster peers after replication grabs it (pretty quick).

Any idea why the current cluster peer wont start using it immediately?

Re: Why does a new field extraction not work on the search head just I created it on, but works immediately on other members in the search head cluster?

BP9906 — Tue, 24 Mar 2015 21:46:42 GMT

After some experimenting, I found that after completing the new field extraction, if I close out of what I was doing and go to a fresh search window (ie flashtimeline) then it would have the new extractions kick in. Odd.

Re: Why does a new field extraction not work on the search head just I created it on, but works immediately on other members in the search head cluster?

strangelaw — Wed, 09 Mar 2016 01:52:43 GMT

Actually, I have similar kind of issue BUT my symptoms are worse 🙂

2 Search Heads on Cluster
Made a Field extraction on node 1 (captain), sourcetype syslog:myown
Took while to show up, works on node 1 perfectly.
Node 2 - it replicates the field extraction, but never allows to use it/stays on list but does not invoke on search.

Anyone seen similar effect? I found no use for closing windows on neither head(s).