Splunk Search

field extraction stopped working after upgrade from 4.1.3 to 4.1.4

alextsui
Path Finder

Hi, After upgrading from 4.1.3 to 4.1.4, the field extraction stoppted working. The field extraction configuration involved uisng the REPORT in the props.conf and referenced to the transforms.conf instead of the EXTRACT. An example is as followed:

props.conf -

[ADM]
REPORT-srcIP = ADM_SRC_IP

transforms.conf -

[ADM_SRC_IP]
REGEX = ip=(\d+\.\d+\.\d+\.\d+)
FORMAT = SRC_IP::$1

Is using the REPORT in the props.conf to extract field unsupported in 4.1.4?

Thanks.

Tags (1)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

This sounds like SPL-31773, and is fixed in 4.1.5. I'm not sure why it would have worked in 4.1.3, however. The problem is that subsearches aren't run with sufficient information to know about the app that they're in. I'd try gkanapathy's suggestion of sharing the extraction globally, and see if that works. You'll have to add export=system to both [props] and [transforms].

dmlee
Communicator

Hi Lowell, actually , we created an App and defined almost 30 fields using REPORT in props.conf , after we upgrade to 4.1.4 , all of those fileds definition doesn't work in "subsearch" . we check the permission , there are all "App" not "Private".

there is another case I filed : http://answers.splunk.com/questions/3834/how-to-use-format-commands , teachers said "There might be a bug such that subsearches do not perform "Private" extractions correctly" .

in this case we found subsearches don't perform "App" extractions too, if we use REPORT instead EXTRACT in props.conf . after we change all field definitions from REPORT to EXTRACT , subsearch works fine .

0 Karma

dmlee
Communicator

Hi gkanapathy,
thanks for your reply . I will check default.meta and local.meta files , BTW, should I add "export = system" under [transforms] section ?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Possibly it's necessary to do an export of the transforms.conf entry in the metadata (local.meta) file. My guess is the props extraction is in the file, but the transforms extraction is not. This might be a bug, but the workaround would be to configure it via the config file instead of the GUI.

0 Karma

Lowell
Super Champion

What splunk app are these defined in? Is is possible that something else changed in your configuration? (Upgrading to 4.1.4 shouldn't cause this problem. I suspect something else is going on.) BTW, since your event should automatically extract "ip" as a field, you could simply use a field alias in your props stanza, like so: FIELDALIAS-ip = ip as SRC_IP

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...