Deployment Architecture
Highlighted

Props and transforms stopped working on search heads

Communicator

I'm using the SplunkTAinfoblox add-on in two ways:

  1. A modified version (with an added TRANSFORMS-1branchindex) on the indexer cluster to split data into 2 indexes;
  2. The original version on a search head cluster to extract all the fields.

The TA was originally deployed without the part 1 above. That worked fine. But now with part 1 deployed, part 2 seems to have stopped working.

When search for "index=ipam_secure sourcetype=infoblox:dns", for example, I get events back but no field extractions.

Since the [infoblox:dns] stanza is unchanged on the search heads, I am puzzled as why the props and transforms stopped working. Any pointers would be much appreciated!

0 Karma