Splunk Search

After upgrading to 4.1, Field extraction is broken in the manager page, what gives?

Splunk Employee
Splunk Employee

When clicking on Field Extractions from Manager, users are greeted with an error message:
In handler 'extractions': Admin handler 'extractions' not found.
and nothing else shows up from there.

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

This is probably an instance of a known issue during an upgrade to 4.1.x.
What is happening is that a file is not deleted while upgrading and a broken link is still showing in Manager.
Confirm if you are seeing two links:
1 - Field Extractions
2 - Fields (and then field extractions within that link)

If so the solution is simple:
1 - do not click on field extractions to extract fields, instead use the "FIELDS" link.
2 - Go to splunk/etc/apps/search/default/data/ui/manager and delete the file data_extractions.xml

I believe you should not be able to see the "Field extractions" link anymore, and so, you will not have the issue.
In the future, you need to make your field extractions in the Fields link.

Hope this helps everyone out there!
.gz

View solution in original post

Splunk Employee
Splunk Employee

This is probably an instance of a known issue during an upgrade to 4.1.x.
What is happening is that a file is not deleted while upgrading and a broken link is still showing in Manager.
Confirm if you are seeing two links:
1 - Field Extractions
2 - Fields (and then field extractions within that link)

If so the solution is simple:
1 - do not click on field extractions to extract fields, instead use the "FIELDS" link.
2 - Go to splunk/etc/apps/search/default/data/ui/manager and delete the file data_extractions.xml

I believe you should not be able to see the "Field extractions" link anymore, and so, you will not have the issue.
In the future, you need to make your field extractions in the Fields link.

Hope this helps everyone out there!
.gz

View solution in original post

Splunk Employee
Splunk Employee

There has been at least one case where a data_extractions.xml file was located in a different location than $SPLUNK_HOME/etc/apps/search/default/data/ui/manager/ and was causing this issue.

Make sure you look for the file in the entire $SPLUNK_HOME/etc/ directory tree.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!