Splunk Search

Help with extraction of field created at index time?

daniel333
Builder

All,

Testing an index'd time field extraction in a test environment. It SEEMS to have worked, but randomly the field I am extracting ( pool ) just disappears from search results.

That is if I just search, pool is extracted the 400 or so times I expect. But once I try and USE that field it's simply missing except for one host. The other 400 in the test setup are not getting extracted.

Heavy Forwarder has this

#transforms.conf
[pool_transform]
REGEX = slcs\d\d(...)\d\d\d
FORMAT = pool::"$1"
WRITE_META = true

#props.conf
[host::*]
TRANSFORMS-indextimepooltransform = pool_transform

#fields.conf
[pool]
INDEXED=true

Search Head has this

    [pool]
    INDEXED=true

Indexer has this

#fields.conf
[pool]
INDEXED=true

Any idea why the field would sorta.. disappear randomly.

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Depending on your version of splunk, you have to have fields.conf in your indexer (6.5 or below)

From 6.6 this is taken from the search head:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Installation/Aboutupgradingto6.6READTHISFIRST#Inde...

Also, make sure that if you're using a seperate app to deploy your fields.conf, that it's shared outside the app using the metadata files.

./app/metadata/default.meta:
[fields]
export = system

0 Karma

maciep
Champion

Not sure i understand the scenario. When you say it's there if you just search the data, you mean like you search index=whatever and the results have the pool field extracted?

And when you say USE it, you mean like index=whatever | table pool .... or something like that? And there's nothing there?

which version of splunk?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...