Splunk Search
Highlighted

field extraction stopped working after upgrade from 4.1.3 to 4.1.4

Path Finder

Hi, After upgrading from 4.1.3 to 4.1.4, the field extraction stoppted working. The field extraction configuration involved uisng the REPORT in the props.conf and referenced to the transforms.conf instead of the EXTRACT. An example is as followed:

props.conf -

[ADM]
REPORT-srcIP = ADM_SRC_IP

transforms.conf -

[ADM_SRC_IP]
REGEX = ip=(\d+\.\d+\.\d+\.\d+)
FORMAT = SRC_IP::$1

Is using the REPORT in the props.conf to extract field unsupported in 4.1.4?

Thanks.

Tags (1)
0 Karma
Highlighted

Re: field extraction stopped working after upgrade from 4.1.3 to 4.1.4

Super Champion

What splunk app are these defined in? Is is possible that something else changed in your configuration? (Upgrading to 4.1.4 shouldn't cause this problem. I suspect something else is going on.) BTW, since your event should automatically extract "ip" as a field, you could simply use a field alias in your props stanza, like so: FIELDALIAS-ip = ip as SRC_IP

0 Karma
Highlighted

Re: field extraction stopped working after upgrade from 4.1.3 to 4.1.4

Communicator

Hi Lowell, actually , we created an App and defined almost 30 fields using REPORT in props.conf , after we upgrade to 4.1.4 , all of those fileds definition doesn't work in "subsearch" . we check the permission , there are all "App" not "Private".

there is another case I filed : http://answers.splunk.com/questions/3834/how-to-use-format-commands , teachers said "There might be a bug such that subsearches do not perform "Private" extractions correctly" .

in this case we found subsearches don't perform "App" extractions too, if we use REPORT instead EXTRACT in props.conf . after we change all field definitions from REPORT to EXTRACT , subsearch works fine .

0 Karma
Highlighted

Re: field extraction stopped working after upgrade from 4.1.3 to 4.1.4

Splunk Employee
Splunk Employee

Possibly it's necessary to do an export of the transforms.conf entry in the metadata (local.meta) file. My guess is the props extraction is in the file, but the transforms extraction is not. This might be a bug, but the workaround would be to configure it via the config file instead of the GUI.

0 Karma
Highlighted

Re: field extraction stopped working after upgrade from 4.1.3 to 4.1.4

Communicator

Hi gkanapathy,
thanks for your reply . I will check default.meta and local.meta files , BTW, should I add "export = system" under [transforms] section ?

0 Karma
Highlighted

Re: field extraction stopped working after upgrade from 4.1.3 to 4.1.4

Splunk Employee
Splunk Employee

This sounds like SPL-31773, and is fixed in 4.1.5. I'm not sure why it would have worked in 4.1.3, however. The problem is that subsearches aren't run with sufficient information to know about the app that they're in. I'd try gkanapathy's suggestion of sharing the extraction globally, and see if that works. You'll have to add export=system to both [props] and [transforms].