Why does Splunk overwrite the 'messages' field in scheduler.log events?

[pkeller]

It seems that scheduler.log events are all prepared for parsing

04-09-2018 23:35:04.548 +0000 ERROR SavedSplunker - savedsearch_id="nobody;my_lookups;Unix DHCP Refresh", message="Error in 'lookup' command: Lookups: The lookup table 'dhcp_lookup' does not exist or is not available.". No actions executed

Yet, etc/app/search/default/props.conf is insistent on overwriting that so that it extracts EVERYTHING after "SavedSplunker - " into the the 'message' field.

[scheduler]
EXTRACT-fields = (?i)^(?:[^ ]* ){2}(?:[+\-]\d+ )?(?P<log_level>[^ ]*)\s+(?P<component>[^ ]+) - (?P<message>.+)

So, now instead of message being: Error in 'lookup' command: Lookups: The lookup table 'dhcp_lookup' does not exist or is not available

it's expanded to:

savedsearch_id="nobody;my_lookups;Unix DHCP Refresh", message="Error in 'lookup' command: Lookups: The lookup table 'dhcp_lookup' does not exist or is not available.". No actions executed
So the question is, why? And why choose the same fieldname that's already been used in the event itself?

It seems that it would have been much more logical to have chosen a different fieldname than 'message'.

Thank you

[somesoni2]

I don't see that field extraction is version 6.2, so not sure in what version it was introduced. It seems like field extraction for the sourcetype splunkd has been copied there is and it's definitely wrong for sourcetype scheduler. I would raise this a bug.

[pkeller]

Thank you I've opened up a ticket on this and have requested that a bug be raised.

Cheers