Splunk Search

INDEXED_EXTRACTIONS error in splunkd.log

znaesh
Path Finder

Can you please advise, what do I do if my Splunk complains often (every couple minutes) in splunkd.log in production environment about

07-06-2018 11:21:04.253 +0300 ERROR IndexedExtractionsConfig - Tried to set INDEXED_EXTRACTIONS but it already had a value! (was: 0, wanted: 😎

I have tried enabling debug logging level for IndexedExtractionsConfig, but got no details.
How can I locate and fix the problem?

0 Karma

znaesh
Path Finder

Are our ufix events considered by server to be erroneously indicated as CSV type? Is it a problem caused by unquoted space chars or something?

Sample ufix event:
"/opt/splunk/var/lib/splunk/xru/db/db_1531217904_1531166719_2035/rawdata","journal.gz",10.07.18 13:18 ,453815577,0,6E09087F,3,-

Sample ufix_status event:
List creation: 0, prj creation: 0, report creation: 0

splunk/etc/apps/x/local/props.conf:

[ufix]
DATETIME_CONFIG = CURRENT
FIELD_NAMES = directory, filename, date, byte_length, line_length, crc, crc_type, id_crc
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = CSV-report by ФИКС-Unix
disabled = false
pulldown_type = true

[ufix_status]
category = Structured
pulldown_type = 1
EXTRACT-list_status = List creation: (?\d*), prj
EXTRACT-prj_status = prj creation: (?\d*),
EXTRACT-report_status = report creation: (?\d*)
DATETIME_CONFIG = CURRENT
FIELD_NAMES = directory, filename, modify_date, byte_length, line_length, crc, crc_type, id_crc
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false

0 Karma

znaesh
Path Finder

Checked that INDEXED_EXTRACTIONS setting is not being redefined several times in any configs.

There are no INDEXED_EXTRACTIONS settings in our server config except for ufix, ufix_status and default config files (unchanged).

ufix and ufix_status events are generated every morning, the should not be causing the minutely error messages.

0 Karma

znaesh
Path Finder

I am fixing a production Splunk with lots of inputs and users, so I cannot just 'start over' a fresh server and find out when the error would reappear again.
Please advise.
How can I track down the input causing the error?
How can I know what is the impact of the error?
What is the best practice to fix it in a proper way?
What is the meaning of this error at all?

0 Karma

ddrillic
Ultra Champion

I see the exact same error at -

alt text

But I can't reach this page from Latest Questions on Splunk Answers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...