Splunk Search

Help with extraction of field created at index time?



Testing an index'd time field extraction in a test environment. It SEEMS to have worked, but randomly the field I am extracting ( pool ) just disappears from search results.

That is if I just search, pool is extracted the 400 or so times I expect. But once I try and USE that field it's simply missing except for one host. The other 400 in the test setup are not getting extracted.

Heavy Forwarder has this

REGEX = slcs\d\d(...)\d\d\d
FORMAT = pool::"$1"

TRANSFORMS-indextimepooltransform = pool_transform


Search Head has this


Indexer has this


Any idea why the field would sorta.. disappear randomly.

0 Karma

Splunk Employee
Splunk Employee

Depending on your version of splunk, you have to have fields.conf in your indexer (6.5 or below)

From 6.6 this is taken from the search head:

Also, make sure that if you're using a seperate app to deploy your fields.conf, that it's shared outside the app using the metadata files.

export = system

0 Karma


Not sure i understand the scenario. When you say it's there if you just search the data, you mean like you search index=whatever and the results have the pool field extracted?

And when you say USE it, you mean like index=whatever | table pool .... or something like that? And there's nothing there?

which version of splunk?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...