Splunk Search

Field extractor warning.

Contributor

Hi,

Lately when I run searches I tend to get a warning on the screen along the lines of:

Field extractor name=access-extractions is unusually slow (max single event time=1140ms, probes=375 warning max=1000ms)

What causes this, and, what should I be looking at to tweak to make Splunk happy again?

Thanks.

Tags (2)
0 Karma
1 Solution

Builder

Howyagoin,

This is a warning message introduced in 4.2.1. It will warn when extractions exceed 1000ms. I have browsed limits.conf without finding a setting to increase this threshold; however I would recommend addressing the underlying extraction.

In this case the "access-extractions" transform Regex may need to be adjusted to provide faster matching. This typically involves anchors which will invalidate the match quicker.

View solution in original post

Builder

Howyagoin,

This is a warning message introduced in 4.2.1. It will warn when extractions exceed 1000ms. I have browsed limits.conf without finding a setting to increase this threshold; however I would recommend addressing the underlying extraction.

In this case the "access-extractions" transform Regex may need to be adjusted to provide faster matching. This typically involves anchors which will invalidate the match quicker.

View solution in original post

Contributor

Thanks for this - I spent some time staring at it and came to the same conclusion last night -- I fear what triggered it was a somewhat imprecise search I was conducting which was indeed going through httpd access files which were indexed. I'll have to work on adding sourcetypes to searches a bit more. Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!