Getting Data In

Props.conf EXTRACT stopped working after stanza change

Burritobizon
Engager

Hello!

This morning, i have changed the configuration of an inline extraction in props.conf.
The original Extraction (this worked):

[source::///var/log/containers/*.log]
EXTRACT-sourcedata = (?<containers>(?<=containers\/).*?(?=_)).(?<namespace>.*(?=_)).(?<service>.*(?=-)) in source

I then changed the extraction to this:

[docker_json]
EXTRACT-sourcedata = (?<containers>(?<=containers\/).*?(?=_)).(?<namespace>.*(?=_)).(?<service>.*(?=-)) in source

because the inputs.conf file defines the sourcetype as follows ...

[monitor:///var/log/containers/*.log]
sourcetype = docker_json
disabled = 0

..., this should work.
however, the change did not work. I proceeded to undo said change, yet the old extraction stopped working as well.

Why is that? Does it take time for splunk to apply inline extractions?

0 Karma

Burritobizon
Engager

I have found the answer as to why the old extraction didn't work:

despite that inputs.conf defines the input as follows:

[monitor:///var/log/containers/*.log]

the stanza in props.conf has to be as follows:

[source::/var/log/containers/*.log]

I apologise for above error also being present in the working version above.
However, that does not explain why the new extraction (using the sourcetype) does not work.

0 Karma

FrankVl
Ultra Champion

At risk of stating the obvious, but:
- did you deploy the config in the right place (your search head(s))?
- you're not rewriting the sourcetype to something else at index time?
- no conflicting configs due to previous attempts? (e.g. check with btool)

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on