Issue with field extractions

[ShaneNewman]

I have setup a field extraction for certain log files. I have the transform set to can-optimize = false and it will still not perform the extraction. That being said, whenever I run the command from the search app (| extract foo_transaction_field_kv ) it works fine

This is the props.conf settings:

[foo_transaction_log]

TIME_FORMAT = %m-%d-%Y %I:%M:%S %p
BREAK_ONLY_BEFORE_DATE = true

REPORT-foo_transaction_field_kv = foo_transaction_field_kv

Is there something I am missing?

[starcher · Accepted solution]

I don't see anything right off as long as the delimeter is in fact a semicolon in your source.
I also assume the sourcetype of the file being indexed is coming in correctly as foo_transaction_log.

Another thing you can try is use | extract reload=true
That will trigger splunk to pull in the updated props and transforms without having to restart splunk. If you added this parsing but have not restarted or done the reload it won't pick it up.

[Ayn]

Do you have some kind of sourcetype aliasing setup? Because if it works with a separate explicit extract but doesn't work "implicitly" that implies that something like this changes at search-time.

[Ayn]

extract reload=t is generally not needed nowadays, due to that searches run in their own processes that will read in all search-time settings at the time of their creation - so changes to search-time properties in props.conf or transforms.conf will be automatically applied without having to restart.

[ShaneNewman]

Tried it, and even restarted the instances... Nothing.

[starcher]

the REPORT line calls a stanza in your transforms.conf by the name after the =. In your case also called foo_transaction_field_kv

Can you show that stanza from the transforms.conf?

[ShaneNewman]

[foo_transaction_field_kv]
DELIMS = ";"
CAN_OPTIMIZE = false
FIELDS = event_timestamp, ip_address, user_action, url, status, token_id, action, null, web_server, full_filname, port_number, logfile_location