Field extractor warning.

[howyagoin]

Hi,

Lately when I run searches I tend to get a warning on the screen along the lines of:

Field extractor name=access-extractions is unusually slow (max single event time=1140ms, probes=375 warning max=1000ms)

What causes this, and, what should I be looking at to tweak to make Splunk happy again?

Thanks.

[hazekamp · Accepted solution]

Howyagoin,

This is a warning message introduced in 4.2.1. It will warn when extractions exceed 1000ms. I have browsed limits.conf without finding a setting to increase this threshold; however I would recommend addressing the underlying extraction.

In this case the "access-extractions" transform Regex may need to be adjusted to provide faster matching. This typically involves anchors which will invalidate the match quicker.

[howyagoin]

Thanks for this - I spent some time staring at it and came to the same conclusion last night -- I fear what triggered it was a somewhat imprecise search I was conducting which was indeed going through httpd access files which were indexed. I'll have to work on adding sourcetypes to searches a bit more. Thanks!