Splunk Search

Why is the field extraction configured in props.conf not showing on the search head for 2-3 days in my search head cluster?

liquid
Engager

I have a search head cluster (splunk 6.2) with two search head members (1 captain,1 search head,1 deployer) and one indexer. I created a field extraction on search head and it has the config in props.conf, but the field extraction is not showing in search head immediately. It takes 2-3 days to show the field extraction. I want to know how to solve this problem.

Steps to Reproduce:
1. I config search head cluster by http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/SHCdeploymentoverview
2. Input data on indexer (search peer)
3. Create a field extraction on search head.
4.Run .../debug/refresh or restart service on search head

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

There are a few issues here.

First, a SHC needs three members in the cluster to function properly. (Two members will not survive a failure, nor elect a captain server to run jobs.)

Second, in what context are you creating the props? Per the docs, if this is application level, you need to create this and save it on the deployer and then redeploy it to all members. If you are creating this as a private extraction, then refer to #1. There is a good chance that due to lack of a captain role being nominated, the sync functionality is not working correctly.

Those are the best places to start.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...