TransformsExtractionHandler - Unable to find stanza. Getting thousands of warnings in _internal splunkd

[joshuamcqueen]

Hey Splunkers,

I'm getting an error in _internal that I can't seem to figure out. Every enabled app that has a csv lookup is throwing this error in splunkd.log. These happen quite frequently -- adding up to 100,000 a day! 😞

Environmont Details: Splunk 6.1. Enterprise Security 3.1

06-26-2014 04:24:00.807 +0000 WARN  TransformsExtractionHandler - Unable to find stanza=identities_expanded.csv in lookups.conf, cannot enumerate fields list
06-26-2014 04:24:00.807 +0000 WARN  TransformsExtractionHandler - Unable to find stanza=pci_domains.csv in lookups.conf, cannot enumerate fields list
06-26-2014 04:24:00.807 +0000 WARN  TransformsExtractionHandler - Unable to find stanza=pci_domains_from_assets.csv in lookups.conf, cannot enumerate fields list
06-26-2014 04:24:00.807 +0000 WARN  TransformsExtractionHandler - Unable to find stanza=assets.csv in lookups.conf, cannot enumerate fields list
06-26-2014 04:24:00.807 +0000 WARN  TransformsExtractionHandler - Unable to find stanza=identities.csv in lookups.conf, cannot enumerate fields list

Why would Splunk complain about every csv lookup in my environment??? I don't get any syantax errors when I start splunk. Any help would be greatly appreciated. Thanks!

[antonioformato]

I have the same problem.
I've just done this change in log.conf "category.TransformsExtractionHandler=ERROR", but issue is still alive.

Any other workaround?

[jervin_splunk]

Did you restart Splunk to make the updated log.cfg take effect? I'm not seeing the messages following a restart, but am likely on a different product version.

To make the settings take effect immediately, you can also do this:

splunk set log-level TransformsExtractionHandler -level ERROR

However I don't think that will persist beyond a restart.

If you continue to have trouble, I'd suggest opening a support case; there could be other issues at play.

[LukeMurphey · Accepted solution]

Its a bug in Splunk. A ticket has been opened for this (ticket number SPL-82145).

[i2sheri]

Is this resolved ?

[yannK]

added as a known issue for splunk 6.1.*
http://docs.splunk.com/Documentation/Splunk/6.1.3/ReleaseNotes/KnownIssues#Search.2C_saved_search.2C...

[jervin_splunk]

The warning is harmless (except for consuming disk space and I/O when being written). You can suppress it by setting this in log.cfg:

category.TransformsExtractionHandler=ERROR

However, you'd lose other warning messages from that category via that solution; caveat emptor.

[joshuamcqueen]

Thanks or the info. Is this warning harmless? Can it be affecting performance? Is there anyway to suppress?