Getting Data In

Why Linux search head does not pick up new search-time extractions or field aliases from Windows indexers' configuration?

gawman
Explorer

I have a Linux server that forwards data (no local indexing) and also acts as a search head with two Windows search peers. There is also another Windows search head using the same search peers that is not having the issues below.

For some reason it is not picking up any new search time extractions or fieldaliases from either props or transforms. I've made sure the permissions were global. I've tried adding apps, modifying existing local/props and transforms, using the extract command (see error below). I can see the configurations in the GUI and in btool but for some reason when I search they are not displayed.

Am I overlooking something simple?

Also, this search head only wants to search os and main index by default, regardless of what I set in roles (more or less restrictive) via the GUI or in /system/local/authorize.conf it still only searches main or os.

Extract command error (same extract works on the other search head):

[Win-Indexer1] Streamed search execute failed because: Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'urltest'.
[Win-Indexer2] Streamed search execute failed because: Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'urltest'.

0 Karma
1 Solution

gawman
Explorer

I was able to fix the issue.

The Linux search head had the OPSEC LEA app which had colons (:) in several of the file names. The Windows search peers were having an issue trying to extract the bundles from the Linux search head (a colon is an invalid character on the NTFS filesystem). Both issues above were fixed after I blacklisted the files in distsearch.conf.

I don't think I fully understand why, but the issue is fixed now.

View solution in original post

0 Karma

gawman
Explorer

I was able to fix the issue.

The Linux search head had the OPSEC LEA app which had colons (:) in several of the file names. The Windows search peers were having an issue trying to extract the bundles from the Linux search head (a colon is an invalid character on the NTFS filesystem). Both issues above were fixed after I blacklisted the files in distsearch.conf.

I don't think I fully understand why, but the issue is fixed now.

0 Karma

gawman
Explorer

New fields are not picked up using the Interactive field extractor either

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...