My current environment is as follows :
Syslog/UF (Universal Forwarder) -> HF (Heavy Forwarder) -> Indexers
I am trying to perform an indexed time field extraction so that people can utilize the fields extracted across all Search Heads in our environment.
The following are what i have now after lots of trying :
[ABC] REGEX = ^.*host\s(?1[^ ]+)\sat.+by\s(?2.+) FORMAT = $0:$1:$2:$3:$4:$5:$6
[sourcetype::XYZ] TRANSFORMS-ABC = a_B_C
I tried pushing this to the indexers to populate the extraction, but it is not working.
Also, the regex works in Search Time Extractions when i use it from the Search Head using a |rex "" command.
Since you're using a Heavy forwarder in between, the event parsing will happen on the Heavy forwarder and these configurations should get deployed to Heavy forwarder not Indexers. Also, you would need to update fields.conf on the Search Head. For complete details on steps, see this link.
There are few issues with your approach that you need to address to do what you are trying to do:
TRANSFORMS-ABC = ABC, where the right side of the equal sign needs to match the stanza in transforms.conf
Look at this older question as a reference: https://answers.splunk.com/answers/103668/index-time-fields-with-heavy-forwarder.html
It worked without the fields.conf being pushed to the Search Heads.
the following were pushed to the HF's