Splunk Search

Delay in search time field extractions on search head cluster

ehowardl3
Path Finder

I have a three-node search head cluster, when I create a field extraction through the GUI, it takes hours for it to become active. This used to take less than 5 minutes, any ideas why this could be happening?

Thanks

woodcock
Esteemed Legend

Try adding ... | extract reload=true to your search to pull in the changes immediately, but this only works for you. If you need it to work for everybody, try this app (thanks @mus):
Add-on Debug Refresh: https://splunkbase.splunk.com/app/1871/

0 Karma

ehowardl3
Path Finder

Thanks for the reply @woodcock , however neither ... | extract reload=true nor running a debug refresh works.

0 Karma

woodcock
Esteemed Legend

I would definitely open a support case. Something is VERY not right. Be sure to report back here what you discover.

0 Karma

ehowardl3
Path Finder

Thanks, I'll open a support case and report back.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...