Splunk Search

Splunk field-extraction strangeness.

Splunker
Communicator

Folks,

Running Splunk 4.2.4 in a distributed setup (1 SH + 1 Indexer).

In the Splunk for Cisco Firewall TA is defined the following in the apps transforms.conf:

[ciscosyslog-action-allowed]
REGEX = (Built|[pP]ermitted)
FORMAT = action::allowed actual_action::$1

Running the following search sourcetype=cisco_asa actual_action=Built works OK.

However, running sourcetype=cisco_asa action=allowed returns no results.

The transform is running, permissions are global read/write (set by the app), and i can see the 'action' field in the field picker, with the value "allowed" in it, but when it's added to the search it returns no results?

Also clicking on the value in the field picker returns no results.

Anyone have any ideas to try? (i've run out...) 🙂

Thanks.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

This sounds very much like the situation described in this blog post: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

View solution in original post

Ayn
Legend

This sounds very much like the situation described in this blog post: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

andrew_garvin
Path Finder

I am having the exact same issue. Can you please post the fix here so others can use it?

0 Karma

woodcock
Esteemed Legend

The fix is to add to fields.conf this:


[action]
INDEXED_VALUE = false

0 Karma

Splunker
Communicator

Thank you Ayn! That was most definitely the issue which is now resolved 🙂

I will also submit this as a bug in the Cisco Firewall TA app (amongst a few others).

0 Karma