topic Re: Why is there a delay in applying field extraction updates? in Splunk Search

Why is there a delay in applying field extraction updates?

phemmer — Mon, 12 Dec 2016 15:12:31 GMT

Whenever I update a field extraction, both from the search head UI field extraction helper, and via props.conf or transforms.conf, it always takes several minutes before the changes take effect.

Why?
Is there any way to speed it up?
Is there anything to monitor in the splunk logs (_internal index) to know when the update has taken effect so I don't have to just rerun the search over and over.

Some possibly relevant details:
Version 6.5.0
Search head clustering in use
props.conf/transforms.conf changes applied from a search head deployer node, and pushed via splunk apply shcluster-bundle.

Re: Why is there a delay in applying field extraction updates?

snoobzilla — Mon, 12 Dec 2016 15:29:15 GMT

Don't know direct answer to your question. I do know that adding | extract reload=true to your searches will force reload at search time which is helpful if the problem statement is troubleshooting field extractions.

Re: Why is there a delay in applying field extraction updates?

phemmer — Mon, 12 Dec 2016 15:45:28 GMT

Has no effect 😞

Re: Why is there a delay in applying field extraction updates?

snoobzilla — Mon, 12 Dec 2016 16:07:37 GMT

Are the extractions it has no effect on working eventually?

Re: Why is there a delay in applying field extraction updates?

phemmer — Mon, 12 Dec 2016 16:10:37 GMT

Yes.

Re: Why is there a delay in applying field extraction updates?

snoobzilla — Mon, 12 Dec 2016 16:14:17 GMT

😞

Re: Why is there a delay in applying field extraction updates?

tb5821 — Tue, 01 Aug 2017 13:41:47 GMT

agree - doesn't seem to work.

Re: Why is there a delay in applying field extraction updates?

tb5821 — Tue, 01 Aug 2017 13:42:02 GMT

I downvoted this post because doesn't work

Re: Why is there a delay in applying field extraction updates?

dd_msearles — Fri, 20 Jul 2018 00:03:59 GMT

Did you ever get to the bottom of this? I've always wondered about this and found it annoying.

Re: Why is there a delay in applying field extraction updates?

woodcock — Fri, 20 Jul 2018 01:13:35 GMT

You can try a bump or a refresh but the latter will probably take longer than waiting:

http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomizationOptions

Re: Why is there a delay in applying field extraction updates?

jeremyhagand61 — Tue, 17 Sep 2019 02:47:11 GMT

I have this problem too