Splunk Search
Highlighted

Splunk field-extraction strangeness.

Communicator

Folks,

Running Splunk 4.2.4 in a distributed setup (1 SH + 1 Indexer).

In the Splunk for Cisco Firewall TA is defined the following in the apps transforms.conf:

[ciscosyslog-action-allowed]
REGEX = (Built|[pP]ermitted)
FORMAT = action::allowed actual_action::$1

Running the following search sourcetype=cisco_asa actual_action=Built works OK.

However, running sourcetype=cisco_asa action=allowed returns no results.

The transform is running, permissions are global read/write (set by the app), and i can see the 'action' field in the field picker, with the value "allowed" in it, but when it's added to the search it returns no results?

Also clicking on the value in the field picker returns no results.

Anyone have any ideas to try? (i've run out...) 🙂

Thanks.

Tags (1)
0 Karma
Highlighted

Re: Splunk field-extraction strangeness.

Legend

This sounds very much like the situation described in this blog post: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

View solution in original post

Highlighted

Re: Splunk field-extraction strangeness.

Communicator

Thank you Ayn! That was most definitely the issue which is now resolved 🙂

I will also submit this as a bug in the Cisco Firewall TA app (amongst a few others).

0 Karma
Highlighted

Re: Splunk field-extraction strangeness.

Path Finder

I am having the exact same issue. Can you please post the fix here so others can use it?

0 Karma
Highlighted

Re: Splunk field-extraction strangeness.

Esteemed Legend

The fix is to add to fields.conf this:


[action]
INDEXED_VALUE = false

0 Karma