Testing an index'd time field extraction in a test environment. It SEEMS to have worked, but randomly the field I am extracting ( pool ) just disappears from search results.
That is if I just search, pool is extracted the 400 or so times I expect. But once I try and USE that field it's simply missing except for one host. The other 400 in the test setup are not getting extracted.
Heavy Forwarder has this
#transforms.conf [pool_transform] REGEX = slcs\d\d(...)\d\d\d FORMAT = pool::"$1" WRITE_META = true #props.conf [host::*] TRANSFORMS-indextimepooltransform = pool_transform #fields.conf [pool] INDEXED=true
Search Head has this
Indexer has this
#fields.conf [pool] INDEXED=true
Any idea why the field would sorta.. disappear randomly.
Not sure i understand the scenario. When you say it's there if you just search the data, you mean like you search index=whatever and the results have the pool field extracted?
And when you say USE it, you mean like index=whatever | table pool .... or something like that? And there's nothing there?
which version of splunk?
Depending on your version of splunk, you have to have fields.conf in your indexer (6.5 or below)
From 6.6 this is taken from the search head:
Also, make sure that if you're using a seperate app to deploy your fields.conf, that it's shared outside the app using the metadata files.
export = system