Splunk Search

Why is the field extraction configured in props.conf not showing on the search head for 2-3 days in my search head cluster?

liquid
Engager

I have a search head cluster (splunk 6.2) with two search head members (1 captain,1 search head,1 deployer) and one indexer. I created a field extraction on search head and it has the config in props.conf, but the field extraction is not showing in search head immediately. It takes 2-3 days to show the field extraction. I want to know how to solve this problem.

Steps to Reproduce:
1. I config search head cluster by http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/SHCdeploymentoverview
2. Input data on indexer (search peer)
3. Create a field extraction on search head.
4.Run .../debug/refresh or restart service on search head

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

There are a few issues here.

First, a SHC needs three members in the cluster to function properly. (Two members will not survive a failure, nor elect a captain server to run jobs.)

Second, in what context are you creating the props? Per the docs, if this is application level, you need to create this and save it on the deployer and then redeploy it to all members. If you are creating this as a private extraction, then refer to #1. There is a good chance that due to lack of a captain role being nominated, the sync functionality is not working correctly.

Those are the best places to start.

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...