Help with extraction of field created at index time?

[daniel333]

All,

Testing an index'd time field extraction in a test environment. It SEEMS to have worked, but randomly the field I am extracting ( pool ) just disappears from search results.

That is if I just search, pool is extracted the 400 or so times I expect. But once I try and USE that field it's simply missing except for one host. The other 400 in the test setup are not getting extracted.

Heavy Forwarder has this

#transforms.conf
[pool_transform]
REGEX = slcs\d\d(...)\d\d\d
FORMAT = pool::"$1"
WRITE_META = true

#props.conf
[host::*]
TRANSFORMS-indextimepooltransform = pool_transform

#fields.conf
[pool]
INDEXED=true

Search Head has this

    [pool]
    INDEXED=true

Indexer has this

#fields.conf
[pool]
INDEXED=true

Any idea why the field would sorta.. disappear randomly.

[mhoogcarspel_sp]

Depending on your version of splunk, you have to have fields.conf in your indexer (6.5 or below)

From 6.6 this is taken from the search head:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Installation/Aboutupgradingto6.6READTHISFIRST#Inde...

Also, make sure that if you're using a seperate app to deploy your fields.conf, that it's shared outside the app using the metadata files.

./app/metadata/default.meta:
[fields]
export = system

[maciep]

Not sure i understand the scenario. When you say it's there if you just search the data, you mean like you search index=whatever and the results have the pool field extracted?

And when you say USE it, you mean like index=whatever | table pool .... or something like that? And there's nothing there?

which version of splunk?