- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Issue with field extractions
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have setup a field extraction for certain log files. I have the transform set to can-optimize = false and it will still not perform the extraction. That being said, whenever I run the command from the search app (| extract foo_transaction_field_kv ) it works fine
This is the props.conf settings:
[foo_transaction_log]
TIME_FORMAT = %m-%d-%Y %I:%M:%S %p
BREAK_ONLY_BEFORE_DATE = true
REPORT-foo_transaction_field_kv = foo_transaction_field_kv
Is there something I am missing?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't see anything right off as long as the delimeter is in fact a semicolon in your source.
I also assume the sourcetype of the file being indexed is coming in correctly as foo_transaction_log.
Another thing you can try is use | extract reload=true
That will trigger splunk to pull in the updated props and transforms without having to restart splunk. If you added this parsing but have not restarted or done the reload it won't pick it up.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't see anything right off as long as the delimeter is in fact a semicolon in your source.
I also assume the sourcetype of the file being indexed is coming in correctly as foo_transaction_log.
Another thing you can try is use | extract reload=true
That will trigger splunk to pull in the updated props and transforms without having to restart splunk. If you added this parsing but have not restarted or done the reload it won't pick it up.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have some kind of sourcetype aliasing setup? Because if it works with a separate explicit extract but doesn't work "implicitly" that implies that something like this changes at search-time.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
extract reload=t is generally not needed nowadays, due to that searches run in their own processes that will read in all search-time settings at the time of their creation - so changes to search-time properties in props.conf or transforms.conf will be automatically applied without having to restart.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Tried it, and even restarted the instances... Nothing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the REPORT line calls a stanza in your transforms.conf by the name after the =. In your case also called foo_transaction_field_kv
Can you show that stanza from the transforms.conf?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[foo_transaction_field_kv]
DELIMS = ";"
CAN_OPTIMIZE = false
FIELDS = event_timestamp, ip_address, user_action, url, status, token_id, action, null, web_server, full_filname, port_number, logfile_location
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
