Splunk Search

field extraction trouble with forwarders

jhedgpeth
Path Finder

I'm really frustrated and need a sanity check on what I'm doing. I've got an indexer which is deploying apps to several heavy forwarders. Each app has inputs, props and transforms for specific server type data. The inputs and props are working great, however I can't get any field extraction to show up on the indexer.

One example:

props.conf ------

[stellent_log]
TRANSFORMS-stellent = stellent_setnull, stellent_keep   *(these work)*
REPORT-verbose = verbose_status
REPORT-heap = heap_status
TIME_FORMAT = %m.%d %H:%M:%S.%3N

transforms.conf ------

[verbose_status]
REGEX = Configuring tracing verbose:\s+(\w+):
FORMAT = verbose_status::$1

[heap_status]
REGEX = (?i)are\s+(?<heapfree>\d+)\s+free[^\d]+\s+(?<heaptotal>\d+)\s+meg
  • I've read http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F (may not have understood this fully)
  • Tested the regex at regexpal.com
  • Copied the transform to $SPLUNK_HOME/etc/system/local/ to see if it was in the wrong place
  • Extracted fields using the same regex from the WebUI which saved in $SPLUNK_HOME/etc/users/admin/search/local (worked)

The only field extraction I have working is from conf files local to the indexer. Am I making a simple mistake?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

All search-time extractions must be defined on the search head (which appears to be the same as the indexer in your case).

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

All search-time extractions must be defined on the search head (which appears to be the same as the indexer in your case).

gkanapathy
Splunk Employee
Splunk Employee

The article about "where do I configure my settings" is fairly explicit about which settings are search-time (and therefore on the search head) and which are input-time or parse-time. If you don't know specifically that you should use a heavy forwarder, then you should use a light forwarder.

0 Karma

jhedgpeth
Path Finder

Thanks for responding. You're right about the indexer/search combo. Since I'm preparing this for my users and I already know the data, I was trying to config this ahead of time (which I thought was non-search-time), or is there only "search-time" extraction? On the other point, do you know where I'd find info to make an educated choice about light/heavy forwarders? My main factor now was that I'm configuring not to forward GBs of data that I can't afford. thanks!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Also, unless you have a good specific reason for doing otherwise, it's recommended that you use light forwarders rather than heavy.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...