Getting Data In

Why are my source types missing after upgrading to Splunk Enterprise 7.2?

asherer_splunk
Splunk Employee
Splunk Employee

Upgraded search head to 7.2, and whenever I search for logs, the majority of source types appear to be missing from the list of available source types.

If I do a search for a particular source, and add "| fields host source sourcetype", the source type is not returned.

If I do a metadata search, or a search from my cluster master for the data, the source types are returned fine. This seems to be a problem only with my upgraded search head.

1 Solution

asherer_splunk
Splunk Employee
Splunk Employee

Upon reviewing configs, there were stanzas in ..etc/search/local/props.conf and ..etc/system/local/props.conf like this:

[host::t*]
FIELDALIAS-t*_sourcedFrom_as_sourcetype = sourcedFrom AS sourcetype sourcedfrom AS sourcetype

[host::pcf]
FIELDALIAS-pcf_Stacktrace_as_StackTrace = Stacktrace AS StackTrace
FIELDALIAS-pcf_sourcedFrom_as_sourcetype = sourcedFrom AS sourcetype sourcedfrom AS sourcetype

[host::*]
FIELDALIAS-allhost_sourcedFrom_as_sourcetype = sourcedFrom AS sourcetype sourcedfrom AS sourcetype

Field aliasing has been changed in 7.2 and these entries broke sourcetypes on the production search head. Once they were removed, and the search head was restarted, the problem was fixed.

View solution in original post

asherer_splunk
Splunk Employee
Splunk Employee

Upon reviewing configs, there were stanzas in ..etc/search/local/props.conf and ..etc/system/local/props.conf like this:

[host::t*]
FIELDALIAS-t*_sourcedFrom_as_sourcetype = sourcedFrom AS sourcetype sourcedfrom AS sourcetype

[host::pcf]
FIELDALIAS-pcf_Stacktrace_as_StackTrace = Stacktrace AS StackTrace
FIELDALIAS-pcf_sourcedFrom_as_sourcetype = sourcedFrom AS sourcetype sourcedfrom AS sourcetype

[host::*]
FIELDALIAS-allhost_sourcedFrom_as_sourcetype = sourcedFrom AS sourcetype sourcedfrom AS sourcetype

Field aliasing has been changed in 7.2 and these entries broke sourcetypes on the production search head. Once they were removed, and the search head was restarted, the problem was fixed.

jpvalenc
Path Finder

Hello,

I know this question has been a while but what exactly is wrong with those FIELDALIAS entries? We seem to have encountered the same error upgrading from 7.1.4 to 7.3.2.

0 Karma

jpvalenc
Path Finder

Thank you very much. That explains it better. 🙂

0 Karma

buysse
Explorer

Was there anything in the documentation about this change? It kind of seems like a big one, and I don't see anything in upgrade notes or anything in the release notes, and it's kind of biting me right now.

0 Karma

asherer_splunk
Splunk Employee
Splunk Employee

I am pushing internally to have something added to the documentation about this, as I believe you are correct and currently there is nothing that denotes this change.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...