I have migrated my data collections from an older Splunk instance to a new clustered environment and am having issues with searches.
The old environment was running Splunk 6.5.2
The new environment is running Splunk 7.2.4
The data appears to be coming in correctly. The props and transforms seem to be firing correctly. When I do a side by side compare of logs in legacy and in new they appear to be identical.
In the below example search I am trying to run, if I peel off everything starting with the first rex all the way to the end I get the logs. But if I put back anything including or after that first rex the query runs through the logs and returns nothing. This exact query is working in my legacy Splunk on the same data.
index=<myindex> "GROUP USER - FINAL RESPONSE" OR ("UiInteractionHoldingsServicesImpl" AND "getHoldingsData :: retail HoldingsList" AND NOT "retail HoldingsList size: 0") OR ("parsePandCHoldings :: pnc HoldingsList" AND NOT "PnC holdingsList size: 0") sourcetype=servicelog* | rex "id=(?<sess>.*):lv=(?<lv>.*):ss=(?<ss>.*)" | convert timeformat="%Y-%m-%d %H" ctime(_time) AS date | dedup sess date | rex ":: - (?<user_type>.*) USER - FINAL RESPONSE" | rex "getHoldingsData :: (?<user_type>.*) HoldingsList" | rex "parsePandCHoldings :: (?<user_type>.*) HoldingsList" | eval new_user_type = case(user_type="GROUP", "Group", user_type="retail", "Retail", user_type="pnc", "Auto and Home", 1=1, user_type) |stats count by new_user_type | collect
