Splunk field-extraction strangeness.

[Splunker]

Folks,

Running Splunk 4.2.4 in a distributed setup (1 SH + 1 Indexer).

In the Splunk for Cisco Firewall TA is defined the following in the apps transforms.conf:

[ciscosyslog-action-allowed]
REGEX = (Built|[pP]ermitted)
FORMAT = action::allowed actual_action::$1

Running the following search sourcetype=cisco_asa actual_action=Built works OK.

However, running sourcetype=cisco_asa action=allowed returns no results.

The transform is running, permissions are global read/write (set by the app), and i can see the 'action' field in the field picker, with the value "allowed" in it, but when it's added to the search it returns no results?

Also clicking on the value in the field picker returns no results.

Anyone have any ideas to try? (i've run out...) 🙂

Thanks.

[Ayn · Accepted solution]

This sounds very much like the situation described in this blog post: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

[andrew_garvin]

I am having the exact same issue. Can you please post the fix here so others can use it?

[woodcock]

The fix is to add to fields.conf this:

[action]

INDEXED_VALUE = false

[Splunker]

Thank you Ayn! That was most definitely the issue which is now resolved 🙂

I will also submit this as a bug in the Cisco Firewall TA app (amongst a few others).