Splunk Search

Delay in search time field extractions on search head cluster

ehowardl3
Path Finder

I have a three-node search head cluster, when I create a field extraction through the GUI, it takes hours for it to become active. This used to take less than 5 minutes, any ideas why this could be happening?

Thanks

woodcock
Esteemed Legend

Try adding ... | extract reload=true to your search to pull in the changes immediately, but this only works for you. If you need it to work for everybody, try this app (thanks @mus):
Add-on Debug Refresh: https://splunkbase.splunk.com/app/1871/

0 Karma

ehowardl3
Path Finder

Thanks for the reply @woodcock , however neither ... | extract reload=true nor running a debug refresh works.

0 Karma

woodcock
Esteemed Legend

I would definitely open a support case. Something is VERY not right. Be sure to report back here what you discover.

0 Karma

ehowardl3
Path Finder

Thanks, I'll open a support case and report back.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...