Splunk Search

Some issues after an upgrade

dholland
New Member

Greetings all,

We just upgraded from 4.0.3 to 4.3.1 and are having a few issues with what seems like local config files not working the same as they used to.

The first problem is with props and transforms. Here is a sample message we might see in our splunk from our .net application:


Apr 20 17:09:41 10.1.1.10 /LM/W3SVC/1831898534/ROOT-1-129793713578578256: 2012-04-20 17:26:47,779
Type= ERROR
Module= Toolbox.ContentPieces.GroupMessage
PrettyUrl= /trd/9/2/4746490/1/viewonline
Referrer=
RawURL= http://it.toolbox.com/r/trd.aspx?pid=9&tid=2&item=4746490&ctid=1&subtype=viewonline&
UserAgent= Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.9 (KHTML, like Gecko)
Chrome/5.0.307.11 Safari/532.9
Message= Unable to get Content Activity records
Contribid=0 LocalID=4746489 type=1

A section of my transforms.conf in etc/system/local/:


[Type_for_sourcetype_syslog_1]
REGEX = Type=(.*?)\n
FORMAT = Type::$1

[Module_for_sourcetype_syslog_1]
REGEX = Module=(.*?)\n
FORMAT = Module::$1

A section from my props.conf in etc/system/local/:


[syslog]

REPORT-Type_for_sourcetype_syslog_1 = Type_for_sourcetype_syslog_1
REPORT-Message_for_sourcetype_syslog_1 = Message_for_sourcetype_syslog_1

Previously this worked, and we would have fields that would show up for Type and Message (among all the others, just giving brief examples) on the left hand side. They still show up as "interesting fields" and fields that are indexed, but they aren't there as default. Secondly in my props.conf is the following:


[syslog]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE_DATE=true
LINE_BREAKER=([\r\n]+)

I'm just posting snippets, this is in the same [syslog] section that was used to define the sourcetypes up above. Now I know SOME of the local configs, because this:

imputs.conf in etc/system/local:


[udp://6164]
disabled = false
sourcetype = syslog

Is working an expected. Any help? Any more info you guys need?

0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

I would suggest opening up a ticket for an upgrade issue. Installing the Splunk on Splunk app from splunkbase could also give you deeper visibility into the root cause as well. This will also make it much easier for support to help triage your problem or anything in the future.

http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

I would suggest opening up a ticket for an upgrade issue. Installing the Splunk on Splunk app from splunkbase could also give you deeper visibility into the root cause as well. This will also make it much easier for support to help triage your problem or anything in the future.

http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk

dholland
New Member

I've submitted a ticket, I'll update here once a resolution is found.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...