Splunk Search

Help with extraction of field created at index time?



Testing an index'd time field extraction in a test environment. It SEEMS to have worked, but randomly the field I am extracting ( pool ) just disappears from search results.

That is if I just search, pool is extracted the 400 or so times I expect. But once I try and USE that field it's simply missing except for one host. The other 400 in the test setup are not getting extracted.

Heavy Forwarder has this

REGEX = slcs\d\d(...)\d\d\d
FORMAT = pool::"$1"

TRANSFORMS-indextimepooltransform = pool_transform


Search Head has this


Indexer has this


Any idea why the field would sorta.. disappear randomly.

0 Karma

Splunk Employee
Splunk Employee

Depending on your version of splunk, you have to have fields.conf in your indexer (6.5 or below)

From 6.6 this is taken from the search head:

Also, make sure that if you're using a seperate app to deploy your fields.conf, that it's shared outside the app using the metadata files.

export = system

0 Karma


Not sure i understand the scenario. When you say it's there if you just search the data, you mean like you search index=whatever and the results have the pool field extracted?

And when you say USE it, you mean like index=whatever | table pool .... or something like that? And there's nothing there?

which version of splunk?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...