Splunk Search

Why is the field extraction configured in props.conf not showing on the search head for 2-3 days in my search head cluster?

liquid
Engager

I have a search head cluster (splunk 6.2) with two search head members (1 captain,1 search head,1 deployer) and one indexer. I created a field extraction on search head and it has the config in props.conf, but the field extraction is not showing in search head immediately. It takes 2-3 days to show the field extraction. I want to know how to solve this problem.

Steps to Reproduce:
1. I config search head cluster by http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/SHCdeploymentoverview
2. Input data on indexer (search peer)
3. Create a field extraction on search head.
4.Run .../debug/refresh or restart service on search head

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

There are a few issues here.

First, a SHC needs three members in the cluster to function properly. (Two members will not survive a failure, nor elect a captain server to run jobs.)

Second, in what context are you creating the props? Per the docs, if this is application level, you need to create this and save it on the deployer and then redeploy it to all members. If you are creating this as a private extraction, then refer to #1. There is a good chance that due to lack of a captain role being nominated, the sync functionality is not working correctly.

Those are the best places to start.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...