Splunk Search

Why is the field extraction configured in props.conf not showing on the search head for 2-3 days in my search head cluster?

liquid
Engager

I have a search head cluster (splunk 6.2) with two search head members (1 captain,1 search head,1 deployer) and one indexer. I created a field extraction on search head and it has the config in props.conf, but the field extraction is not showing in search head immediately. It takes 2-3 days to show the field extraction. I want to know how to solve this problem.

Steps to Reproduce:
1. I config search head cluster by http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/SHCdeploymentoverview
2. Input data on indexer (search peer)
3. Create a field extraction on search head.
4.Run .../debug/refresh or restart service on search head

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

There are a few issues here.

First, a SHC needs three members in the cluster to function properly. (Two members will not survive a failure, nor elect a captain server to run jobs.)

Second, in what context are you creating the props? Per the docs, if this is application level, you need to create this and save it on the deployer and then redeploy it to all members. If you are creating this as a private extraction, then refer to #1. There is a good chance that due to lack of a captain role being nominated, the sync functionality is not working correctly.

Those are the best places to start.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...