Splunk Search

Issue with field extractions

ShaneNewman
Motivator

I have setup a field extraction for certain log files. I have the transform set to can-optimize = false and it will still not perform the extraction. That being said, whenever I run the command from the search app (| extract foo_transaction_field_kv ) it works fine

This is the props.conf settings:

[foo_transaction_log]

TIME_FORMAT = %m-%d-%Y %I:%M:%S %p
BREAK_ONLY_BEFORE_DATE = true

REPORT-foo_transaction_field_kv = foo_transaction_field_kv

Is there something I am missing?

Tags (1)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

I don't see anything right off as long as the delimeter is in fact a semicolon in your source.
I also assume the sourcetype of the file being indexed is coming in correctly as foo_transaction_log.

Another thing you can try is use | extract reload=true
That will trigger splunk to pull in the updated props and transforms without having to restart splunk. If you added this parsing but have not restarted or done the reload it won't pick it up.

View solution in original post

starcher
SplunkTrust
SplunkTrust

I don't see anything right off as long as the delimeter is in fact a semicolon in your source.
I also assume the sourcetype of the file being indexed is coming in correctly as foo_transaction_log.

Another thing you can try is use | extract reload=true
That will trigger splunk to pull in the updated props and transforms without having to restart splunk. If you added this parsing but have not restarted or done the reload it won't pick it up.

Ayn
Legend

Do you have some kind of sourcetype aliasing setup? Because if it works with a separate explicit extract but doesn't work "implicitly" that implies that something like this changes at search-time.

0 Karma

Ayn
Legend

extract reload=t is generally not needed nowadays, due to that searches run in their own processes that will read in all search-time settings at the time of their creation - so changes to search-time properties in props.conf or transforms.conf will be automatically applied without having to restart.

0 Karma

ShaneNewman
Motivator

Tried it, and even restarted the instances... Nothing.

0 Karma

starcher
SplunkTrust
SplunkTrust

the REPORT line calls a stanza in your transforms.conf by the name after the =. In your case also called foo_transaction_field_kv

Can you show that stanza from the transforms.conf?

0 Karma

ShaneNewman
Motivator

[foo_transaction_field_kv]
DELIMS = ";"
CAN_OPTIMIZE = false
FIELDS = event_timestamp, ip_address, user_action, url, status, token_id, action, null, web_server, full_filname, port_number, logfile_location

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...