Splunk Search

Delay in search time field extractions on search head cluster

ehowardl3
Path Finder

I have a three-node search head cluster, when I create a field extraction through the GUI, it takes hours for it to become active. This used to take less than 5 minutes, any ideas why this could be happening?

Thanks

woodcock
Esteemed Legend

Try adding ... | extract reload=true to your search to pull in the changes immediately, but this only works for you. If you need it to work for everybody, try this app (thanks @mus):
Add-on Debug Refresh: https://splunkbase.splunk.com/app/1871/

0 Karma

ehowardl3
Path Finder

Thanks for the reply @woodcock , however neither ... | extract reload=true nor running a debug refresh works.

0 Karma

woodcock
Esteemed Legend

I would definitely open a support case. Something is VERY not right. Be sure to report back here what you discover.

0 Karma

ehowardl3
Path Finder

Thanks, I'll open a support case and report back.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...