Archive
Highlighted

Help with extraction of field created at index time?

Builder

All,

Testing an index'd time field extraction in a test environment. It SEEMS to have worked, but randomly the field I am extracting ( pool ) just disappears from search results.

That is if I just search, pool is extracted the 400 or so times I expect. But once I try and USE that field it's simply missing except for one host. The other 400 in the test setup are not getting extracted.

Heavy Forwarder has this

#transforms.conf
[pool_transform]
REGEX = slcs\d\d(...)\d\d\d
FORMAT = pool::"$1"
WRITE_META = true

#props.conf
[host::*]
TRANSFORMS-indextimepooltransform = pool_transform

#fields.conf
[pool]
INDEXED=true

Search Head has this

    [pool]
    INDEXED=true

Indexer has this

#fields.conf
[pool]
INDEXED=true

Any idea why the field would sorta.. disappear randomly.

0 Karma
Highlighted

Re: Help with extraction of field created at index time?

Champion

Not sure i understand the scenario. When you say it's there if you just search the data, you mean like you search index=whatever and the results have the pool field extracted?

And when you say USE it, you mean like index=whatever | table pool .... or something like that? And there's nothing there?

which version of splunk?

0 Karma
Highlighted

Re: Help with extraction of field created at index time?

Splunk Employee
Splunk Employee

Depending on your version of splunk, you have to have fields.conf in your indexer (6.5 or below)

From 6.6 this is taken from the search head:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Installation/Aboutupgradingto6.6READTHISFIRST#Inde...

Also, make sure that if you're using a seperate app to deploy your fields.conf, that it's shared outside the app using the metadata files.

./app/metadata/default.meta:
[fields]
export = system

0 Karma