Updated props/transforms don't change the search result

[viraptor]

I've updated the props in on a 6.1 server. Checked with btool which claims my configs are acceptable.

I've also checked btool props and see the updated REPORT-access as well as EVAL-some_name.

I tried loading /debug/refresh which does show Refreshing admin/transforms-extract OK

But when loading a few lines from the logs, I don't see any fields which I added. Neither the ones from a new REPORT, nor the one from EVAL. Everything looks just like it did before.

What else am I missing? Is there something else I can try to debug?

[lguinn2]

Are you certain that the data has the same sourcetype as you specified in props.conf and transforms.conf? Might you have a typo in one or more of these files? btool is great, but it only checks syntax. btool can't test the actual formatting or regular expressions since it only looks at the configuration files, not the data.

If these hints don't help, please post the relevant stanzas from props.conf and transforms.conf. A little sample data (properly anonymized of course) would also be useful to help the community answer your question.

[viraptor]

I've got a host which adds the processing time to the end of nginx log line. This looks like the following:

client_ip - - [03/Mar/2017:09:54:56 +1100] "GET /some/path HTTP/1.1" 200 233474 "https://some/referer" "useragent" "cookies" "0.662"

This normally gets parsed by access_combined_wcookie, but sticks "0.662" into "other" field. I want to create a req_duration, so I added apps/marketplace/default/props.conf:

[access_combined_wcookie]
[source::/var/log/marketplace/nginx-access.log]
REPORT-access = access-extractions-marketplace

and apps/marketplace/default/transforms.conf:

[access-extractions-marketplace]
# based on system access-extractions, but with extra req_duration at the end
REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[access-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?<referer>[[bc_domain:referer_]]?+[^"]*+)"(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?\s++"[[float:req_duration]]"[[all:other]]

The search results are not changed however. All looks the same after reloads.

[DalJeanis]

have you restarted splunk since changing the .confs??

[viraptor]

@DalJeanis no, according to the docs, the reload should be enough to do this.