Splunk Search

field extraction stopped working after upgrade from 4.1.3 to 4.1.4

Path Finder

Hi, After upgrading from 4.1.3 to 4.1.4, the field extraction stoppted working. The field extraction configuration involved uisng the REPORT in the props.conf and referenced to the transforms.conf instead of the EXTRACT. An example is as followed:

props.conf -

[ADM]
REPORT-srcIP = ADM_SRC_IP

transforms.conf -

[ADM_SRC_IP]
REGEX = ip=(\d+\.\d+\.\d+\.\d+)
FORMAT = SRC_IP::$1

Is using the REPORT in the props.conf to extract field unsupported in 4.1.4?

Thanks.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

This sounds like SPL-31773, and is fixed in 4.1.5. I'm not sure why it would have worked in 4.1.3, however. The problem is that subsearches aren't run with sufficient information to know about the app that they're in. I'd try gkanapathy's suggestion of sharing the extraction globally, and see if that works. You'll have to add export=system to both [props] and [transforms].

Communicator

Hi Lowell, actually , we created an App and defined almost 30 fields using REPORT in props.conf , after we upgrade to 4.1.4 , all of those fileds definition doesn't work in "subsearch" . we check the permission , there are all "App" not "Private".

there is another case I filed : http://answers.splunk.com/questions/3834/how-to-use-format-commands , teachers said "There might be a bug such that subsearches do not perform "Private" extractions correctly" .

in this case we found subsearches don't perform "App" extractions too, if we use REPORT instead EXTRACT in props.conf . after we change all field definitions from REPORT to EXTRACT , subsearch works fine .

0 Karma

Communicator

Hi gkanapathy,
thanks for your reply . I will check default.meta and local.meta files , BTW, should I add "export = system" under [transforms] section ?

0 Karma

Splunk Employee
Splunk Employee

Possibly it's necessary to do an export of the transforms.conf entry in the metadata (local.meta) file. My guess is the props extraction is in the file, but the transforms extraction is not. This might be a bug, but the workaround would be to configure it via the config file instead of the GUI.

0 Karma

Super Champion

What splunk app are these defined in? Is is possible that something else changed in your configuration? (Upgrading to 4.1.4 shouldn't cause this problem. I suspect something else is going on.) BTW, since your event should automatically extract "ip" as a field, you could simply use a field alias in your props stanza, like so: FIELDALIAS-ip = ip as SRC_IP

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!