field extraction stopped working after upgrade from 4.1.3 to 4.1.4

[alextsui]

Hi, After upgrading from 4.1.3 to 4.1.4, the field extraction stoppted working. The field extraction configuration involved uisng the REPORT in the props.conf and referenced to the transforms.conf instead of the EXTRACT. An example is as followed:

props.conf -

[ADM]
REPORT-srcIP = ADM_SRC_IP

transforms.conf -

[ADM_SRC_IP]
REGEX = ip=(\d+\.\d+\.\d+\.\d+)
FORMAT = SRC_IP::$1

Is using the REPORT in the props.conf to extract field unsupported in 4.1.4?

Thanks.

[Stephen_Sorkin]

This sounds like SPL-31773, and is fixed in 4.1.5. I'm not sure why it would have worked in 4.1.3, however. The problem is that subsearches aren't run with sufficient information to know about the app that they're in. I'd try gkanapathy's suggestion of sharing the extraction globally, and see if that works. You'll have to add export=system to both [props] and [transforms].

[dmlee]

Hi Lowell, actually , we created an App and defined almost 30 fields using REPORT in props.conf , after we upgrade to 4.1.4 , all of those fileds definition doesn't work in "subsearch" . we check the permission , there are all "App" not "Private".

there is another case I filed : http://answers.splunk.com/questions/3834/how-to-use-format-commands , teachers said "There might be a bug such that subsearches do not perform "Private" extractions correctly" .

in this case we found subsearches don't perform "App" extractions too, if we use REPORT instead EXTRACT in props.conf . after we change all field definitions from REPORT to EXTRACT , subsearch works fine .

[dmlee]

Hi gkanapathy,
thanks for your reply . I will check default.meta and local.meta files , BTW, should I add "export = system" under [transforms] section ?

[gkanapathy]

Possibly it's necessary to do an export of the transforms.conf entry in the metadata (local.meta) file. My guess is the props extraction is in the file, but the transforms extraction is not. This might be a bug, but the workaround would be to configure it via the config file instead of the GUI.

[Lowell]

What splunk app are these defined in? Is is possible that something else changed in your configuration? (Upgrading to 4.1.4 shouldn't cause this problem. I suspect something else is going on.) BTW, since your event should automatically extract "ip" as a field, you could simply use a field alias in your props stanza, like so: FIELDALIAS-ip = ip as SRC_IP