field extraction trouble with forwarders

[jhedgpeth]

I'm really frustrated and need a sanity check on what I'm doing. I've got an indexer which is deploying apps to several heavy forwarders. Each app has inputs, props and transforms for specific server type data. The inputs and props are working great, however I can't get any field extraction to show up on the indexer.

One example:

props.conf ------

[stellent_log]
TRANSFORMS-stellent = stellent_setnull, stellent_keep   *(these work)*
REPORT-verbose = verbose_status
REPORT-heap = heap_status
TIME_FORMAT = %m.%d %H:%M:%S.%3N

transforms.conf ------

[verbose_status]
REGEX = Configuring tracing verbose:\s+(\w+):
FORMAT = verbose_status::$1

[heap_status]
REGEX = (?i)are\s+(?<heapfree>\d+)\s+free[^\d]+\s+(?<heaptotal>\d+)\s+meg

• I've read http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F (may not have understood this fully)
• Tested the regex at regexpal.com
• Copied the transform to $SPLUNK_HOME/etc/system/local/ to see if it was in the wrong place
• Extracted fields using the same regex from the WebUI which saved in $SPLUNK_HOME/etc/users/admin/search/local (worked)

The only field extraction I have working is from conf files local to the indexer. Am I making a simple mistake?

[gkanapathy · Accepted solution]

All search-time extractions must be defined on the search head (which appears to be the same as the indexer in your case).

[gkanapathy]

The article about "where do I configure my settings" is fairly explicit about which settings are search-time (and therefore on the search head) and which are input-time or parse-time. If you don't know specifically that you should use a heavy forwarder, then you should use a light forwarder.

[jhedgpeth]

Thanks for responding. You're right about the indexer/search combo. Since I'm preparing this for my users and I already know the data, I was trying to config this ahead of time (which I thought was non-search-time), or is there only "search-time" extraction? On the other point, do you know where I'd find info to make an educated choice about light/heavy forwarders? My main factor now was that I'm configuring not to forward GBs of data that I can't afford. thanks!

[gkanapathy]

Also, unless you have a good specific reason for doing otherwise, it's recommended that you use light forwarders rather than heavy.