Splunk Search

Issue with field extractions

ShaneNewman
Motivator

I have setup a field extraction for certain log files. I have the transform set to can-optimize = false and it will still not perform the extraction. That being said, whenever I run the command from the search app (| extract foo_transaction_field_kv ) it works fine

This is the props.conf settings:

[foo_transaction_log]

TIME_FORMAT = %m-%d-%Y %I:%M:%S %p
BREAK_ONLY_BEFORE_DATE = true

REPORT-foo_transaction_field_kv = foo_transaction_field_kv

Is there something I am missing?

Tags (1)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

I don't see anything right off as long as the delimeter is in fact a semicolon in your source.
I also assume the sourcetype of the file being indexed is coming in correctly as foo_transaction_log.

Another thing you can try is use | extract reload=true
That will trigger splunk to pull in the updated props and transforms without having to restart splunk. If you added this parsing but have not restarted or done the reload it won't pick it up.

View solution in original post

starcher
SplunkTrust
SplunkTrust

I don't see anything right off as long as the delimeter is in fact a semicolon in your source.
I also assume the sourcetype of the file being indexed is coming in correctly as foo_transaction_log.

Another thing you can try is use | extract reload=true
That will trigger splunk to pull in the updated props and transforms without having to restart splunk. If you added this parsing but have not restarted or done the reload it won't pick it up.

Ayn
Legend

Do you have some kind of sourcetype aliasing setup? Because if it works with a separate explicit extract but doesn't work "implicitly" that implies that something like this changes at search-time.

0 Karma

Ayn
Legend

extract reload=t is generally not needed nowadays, due to that searches run in their own processes that will read in all search-time settings at the time of their creation - so changes to search-time properties in props.conf or transforms.conf will be automatically applied without having to restart.

0 Karma

ShaneNewman
Motivator

Tried it, and even restarted the instances... Nothing.

0 Karma

starcher
SplunkTrust
SplunkTrust

the REPORT line calls a stanza in your transforms.conf by the name after the =. In your case also called foo_transaction_field_kv

Can you show that stanza from the transforms.conf?

0 Karma

ShaneNewman
Motivator

[foo_transaction_field_kv]
DELIMS = ";"
CAN_OPTIMIZE = false
FIELDS = event_timestamp, ip_address, user_action, url, status, token_id, action, null, web_server, full_filname, port_number, logfile_location

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...