Why are my fields Missing after upgrade?

[cmcclure_splunk]

After upgrading from 4.2 to 4.2.1 all my inputs do not seem to be working. My props.conf file and transforms.conf file have not changed. I also moved those files to etc\system\local from the "bundle" folder and restarted Splunk. The inputs are still not showing up.

[cmcclure_splunk · Accepted solution]

You may want to try checking on each part of the files from the beginning to the end..

1. Are your events being indexed by Splunk without any field extractions?
2. If the event is parsed but the fields are not extracted, ensure that fields that are being used in props.conf are being found correctly (e.g. The host field matches the stanza in props.conf [host::123.456.789.001]) You may want to test this by creating a test stanza that points directly to the source, for example [source::/some/dir/with/a/test.file]
3. Ensure that your transforms.conf contains the correct capture groups for extracting your variables, there are several ways to do this and you will want to check against the documentation for using config files to perform field extractions and also with the transforms.conf.spec
4. You also want to make sure that you do not have the Field Discovery toggle set to "Off" as this will hide the extracted fields from the search UI. (see pictures below)

To see fields

Fields hidden