Splunk Search

Fields that were once extracted aren't being extracted anymore... why?

_dave_b
Communicator

Hey there,

I made an app. It worked good and extracted data exactly the way I wanted it to. I am now trying to duplicate the app, using the same custom field extractions, but some key fields aren't being extracted, despite using the exact same regex as before!

The permissions are global for all objects in the app. Anybody have any ideas why my fields won't get extracted?

Thanks

1 Solution

skoelpin
SplunkTrust
SplunkTrust

Your fields are relative to the sourcetype. Can you verify that your sourcetype has not changed?

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

Your fields are relative to the sourcetype. Can you verify that your sourcetype has not changed?

_dave_b
Communicator

Thanks for your reply. I just did a global search checked the sourcetype. The sourcetype specified in the search has changed. Originally it was 'sourcetype-ts', Splunk appended 'too_small', so now it's being reported as 'sourcetype-too_small'.

Why does Splunk do this and how can I get around it? A little searching tells me Splunk does this to CSV files when it gets confused by them, but my log files aren't CSV, they just plain text, formatted with date-time stamps. I edited props.conf in the $SPLUNK_HOME\etc\system\local to like this:

[source::c:\Program Files\OS\Logs\*\LogType-TS*.txt]
sourcetype=OS_LogType-TS

where the first * wildcard is there to consume a YYYYMMDD value and the second * wildcard consumes anything that may get appended by Splunk, like too-small. I was hoping that all the sourcetypes with 'too-small' appended to the name would be read

0 Karma

skoelpin
SplunkTrust
SplunkTrust

As @somesoni2 pointed out, you should assign the sourcetype in your inputs.conf (On the forwarder) so it won't change. This will prevent the problems in the future, or in your case sourcetypes changing

0 Karma

_dave_b
Communicator

Thanks. It still doesn't work, though 😞

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Why not assign the sourcetype in the data inputs (inputs.conf)?

_dave_b
Communicator

According to the docs for props.conf, sourcetype can be used as a spec for a stanza, so that's what I did, in hopes that the sourcetype would be more closely associated with my custom field extractions.

0 Karma

_dave_b
Communicator

That's a good idea. I've tried that, so my inputs.conf now looks like

[monitor://c:\Program Files\Blackberry\BES\Logs\*\BES12_BSCP-TS*.txt]
0 Karma

skoelpin
SplunkTrust
SplunkTrust

That's incorrect. Your stanza should look like this.. Don't forget to restart the Splunk service

[Source::YOUR SOURCE]
host = HOSTNAME
sourcetype = OS_LogType-TS
0 Karma

_dave_b
Communicator

What about when the sourcetype is named OS_LogType-TS1, or OS_LogType-TS2?

I changed the inputs.conf in my app's local directory to look like what you said it should look like, but I am still getting no results. My sourcetypes keep changing with numbers appended to their names.

I briefly had some success, but that was by changing the the props.conf file in the system directory. But since I plan on exporting this, app I need to keep all of my custom conf files in local, so that change couldn't apply.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Did you restart the Splunk service after making those changes?

Also, did you change the inputs.conf on the indexer or the forwarder?

0 Karma

_dave_b
Communicator

I restarted the Splunk service, _bumped my version number, my indexer is the same machine my forwarder.

My props.conf looks like

[source::c:\\Program Files\\OS_Log\\*\\OS_LogType-TS*.txt]
[OS_LogType-TS]
EXTRACT-deviceIdAndCorrelationId = \[\S+\-(?P[0-9A-Ha-h]{8})\/(?P[\S]{32})\]

and my inputs.conf looks like

`[source::c:\\Program Files\\OS_Logs\\*\\BES12_BSCP-TS*.txt]
disabled = false
host = $decideOnStartup
sourcetype = BES12_BSCP-TS`

And I thought the deviceIdAndCorrelationId field should show up in the web interface under extracted fields for my app, but it isn't there.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Ah I found the problem! This stanza should be in your props.conf not the inputs.conf, this should have been obvious LOL, doh!

Add this stanza to your props.conf on the indexer and restart the Splunk service

[source::c:\\Program Files\\OS_Logs\\*\\BES12_BSCP-TS*.txt]
 disabled = false
 host = $decideOnStartup
 sourcetype = BES12_BSCP-TS

http://docs.splunk.com/Documentation/Splunk/6.1/Data/Bypassautomaticsourcetypeassignment

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Did this solve your sourcetype issue?

0 Karma

_dave_b
Communicator

I'm still having the same problems. Different sourcetypes are being included in the events, so that's at least some progress, but the fields still aren't being extracted.

I guess I will try using a different command, like report or transform...

0 Karma

_dave_b
Communicator

Hey skoelpin, my sourcetype issue appears to have been solved! I'm a little tenuous on putting this issue to rest, because I've tried several different methods, but the last thing I tried was setting it via Splunkweb. I also changed the inputs and props.conf files in $SPLUNK_HOME/etc/system. They didn't seem to take effect at first, but maybe there was a delayed reaction.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You're asking a separate question.. Let's address the static sourcetype issue. If you included the sourcetype in your props.conf and restarted the service, then any log files in c:\\Program Files\\OS_Logs\\*\\BES12_BSCP-TS*.txt path will be assigned the sourcetype of BES12_BSCP-TS

Read this doc which explains overriding sourcetypes

http://docs.splunk.com/Documentation/Splunk/6.1/Data/Bypassautomaticsourcetypeassignment

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Your asking a different question.. Let's solve the static sourcetype issue first, then create a second question to solve your transform.conf issue. This doc shows multiple ways of assigning a static sourcetype to your events

http://docs.splunk.com/Documentation/Splunk/6.1/Data/Bypassautomaticsourcetypeassignment

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...