Getting Data In

Why Linux search head does not pick up new search-time extractions or field aliases from Windows indexers' configuration?

gawman
Explorer

I have a Linux server that forwards data (no local indexing) and also acts as a search head with two Windows search peers. There is also another Windows search head using the same search peers that is not having the issues below.

For some reason it is not picking up any new search time extractions or fieldaliases from either props or transforms. I've made sure the permissions were global. I've tried adding apps, modifying existing local/props and transforms, using the extract command (see error below). I can see the configurations in the GUI and in btool but for some reason when I search they are not displayed.

Am I overlooking something simple?

Also, this search head only wants to search os and main index by default, regardless of what I set in roles (more or less restrictive) via the GUI or in /system/local/authorize.conf it still only searches main or os.

Extract command error (same extract works on the other search head):

[Win-Indexer1] Streamed search execute failed because: Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'urltest'.
[Win-Indexer2] Streamed search execute failed because: Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'urltest'.

0 Karma
1 Solution

gawman
Explorer

I was able to fix the issue.

The Linux search head had the OPSEC LEA app which had colons (:) in several of the file names. The Windows search peers were having an issue trying to extract the bundles from the Linux search head (a colon is an invalid character on the NTFS filesystem). Both issues above were fixed after I blacklisted the files in distsearch.conf.

I don't think I fully understand why, but the issue is fixed now.

View solution in original post

0 Karma

gawman
Explorer

I was able to fix the issue.

The Linux search head had the OPSEC LEA app which had colons (:) in several of the file names. The Windows search peers were having an issue trying to extract the bundles from the Linux search head (a colon is an invalid character on the NTFS filesystem). Both issues above were fixed after I blacklisted the files in distsearch.conf.

I don't think I fully understand why, but the issue is fixed now.

0 Karma

gawman
Explorer

New fields are not picked up using the Interactive field extractor either

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...