action field is not returning any results from all indexes

[majid87]

Hello,

Looks like the action field is not returning results for almost all of the indexes. This is only impacting one of the search heads, the action field is working normally in the other search heads ( NOT clustered ). 

ex: index=foo ( returns all data ) but when i add index=foo action=allowed returns almost nothing 

[majid87]

isoutamo

 I meant the default in /etc/apps/app-TA/default. I did not make any changes to it , I'm using the default props/transforms that come with the TA . I know if i need to make any changes on the conf files, i should do it in the local folder , however, in my case, i did not need it . This is impacting all users including the admin. Not sure if this is related to CIM TA , i should also mention the SH has ES installed on it .

[isoutamo]

Hi

this sounds like you are missing some props.conf (and/or transforms.conf) on this one SH. Just look from those others where that has defined 

splunk btool props list <your sourcetype name> --debug

 Then put those definitions to TA (unless it already is in TA/app) and deploy this to that SH. If those are already defined in separate TA/app, then copy it to that SH.

r. Ismo

[majid87]

Thanks isoutamo ,

The issue is not impacting a specific app/TA, it seems to be impacting all indexes. Also, I have compared the two SHs and did not see anything missing from the impacted SH.  I Have run the btool but I have not noticed any issues. 

I should mention that I'm using props/transforms in the default folder and it's been working properly till recently. No changes have been made that I'm aware of.

[isoutamo]

When you are saying “default” folder are you meaning …/etc/system/default and have you changed those? And you haven’t anything in any local folders? 
Is this issue for all users or only for you?