Why Linux search head does not pick up new search-time extractions or field aliases from Windows indexers' configuration?

[gawman]

I have a Linux server that forwards data (no local indexing) and also acts as a search head with two Windows search peers. There is also another Windows search head using the same search peers that is not having the issues below.

For some reason it is not picking up any new search time extractions or fieldaliases from either props or transforms. I've made sure the permissions were global. I've tried adding apps, modifying existing local/props and transforms, using the extract command (see error below). I can see the configurations in the GUI and in btool but for some reason when I search they are not displayed.

Am I overlooking something simple?

Also, this search head only wants to search os and main index by default, regardless of what I set in roles (more or less restrictive) via the GUI or in /system/local/authorize.conf it still only searches main or os.

Extract command error (same extract works on the other search head):

[Win-Indexer1] Streamed search execute failed because: Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'urltest'.
[Win-Indexer2] Streamed search execute failed because: Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'urltest'.

[gawman · Accepted solution]

I was able to fix the issue.

The Linux search head had the OPSEC LEA app which had colons (:) in several of the file names. The Windows search peers were having an issue trying to extract the bundles from the Linux search head (a colon is an invalid character on the NTFS filesystem). Both issues above were fixed after I blacklisted the files in distsearch.conf.

I don't think I fully understand why, but the issue is fixed now.

[gawman]

New fields are not picked up using the Interactive field extractor either