Anyone have trouble with the Field Extractor app on 4.3.3?

[umiotoko]

http://splunk-base.splunk.com/apps/22291/field-extractor

I can launch the app, but as soon as click on the and choose something (syslog, or others), or after changing it to host and choosing a host, it goes into the spinning wait icon forever. The server also stops responding to all other splunk queries, requires a splunkweb restart to recover. I suck at regex, so this app would be great if I could make it work.

[carasso · Accepted solution]

Hi, I wrote the field extractor app.

I've seen this problem before. It's doing a slow operation that adds negligible benefit. It will come back but I agree it takes way to long.

I know exactly why it is, and I can make it be lightening fast,
and disable this feature and make it an option in the options dialog.

What it's trying to do is determine if other props.conf stanzas are relevant.
This app not only lets you make new extractions but also lets you edit existing extractions.
In order to determine which stanzas are relevant for existing extractions it has to do something very expensive. For example, if you say you're interested in sourcetype=syslog
and there's another stanza that is source=davidmac:123, which has some extractions on it,
it could very well be that those extractions are relevant to sourcetype=syslog. We have no
convenient way of knowing that two stanzas are relevant to each other, so I have to run
searches against source=syslog and see if i ever see davidmac:123 or any other stanza setting.
I can disable this and the only downside is that for existing stanzas you may not see some
other relevant stanzas.

I'll update it in future version.