I have a search head cluster (splunk 6.2) with two search head members (1 captain,1 search head,1 deployer) and one indexer. I created a field extraction on search head and it has the config in props.conf, but the field extraction is not showing in search head immediately. It takes 2-3 days to show the field extraction. I want to know how to solve this problem.
Steps to Reproduce:
1. I config search head cluster by http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/SHCdeploymentoverview
2. Input data on indexer (search peer)
3. Create a field extraction on search head.
4.Run .../debug/refresh or restart service on search head
There are a few issues here.
First, a SHC needs three members in the cluster to function properly. (Two members will not survive a failure, nor elect a captain server to run jobs.)
Second, in what context are you creating the props? Per the docs, if this is application level, you need to create this and save it on the deployer and then redeploy it to all members. If you are creating this as a private extraction, then refer to #1. There is a good chance that due to lack of a captain role being nominated, the sync functionality is not working correctly.
Those are the best places to start.