Splunk Search

field extraction trouble with forwarders

jhedgpeth
Path Finder

I'm really frustrated and need a sanity check on what I'm doing. I've got an indexer which is deploying apps to several heavy forwarders. Each app has inputs, props and transforms for specific server type data. The inputs and props are working great, however I can't get any field extraction to show up on the indexer.

One example:

props.conf ------

[stellent_log]
TRANSFORMS-stellent = stellent_setnull, stellent_keep   *(these work)*
REPORT-verbose = verbose_status
REPORT-heap = heap_status
TIME_FORMAT = %m.%d %H:%M:%S.%3N

transforms.conf ------

[verbose_status]
REGEX = Configuring tracing verbose:\s+(\w+):
FORMAT = verbose_status::$1

[heap_status]
REGEX = (?i)are\s+(?<heapfree>\d+)\s+free[^\d]+\s+(?<heaptotal>\d+)\s+meg
  • I've read http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F (may not have understood this fully)
  • Tested the regex at regexpal.com
  • Copied the transform to $SPLUNK_HOME/etc/system/local/ to see if it was in the wrong place
  • Extracted fields using the same regex from the WebUI which saved in $SPLUNK_HOME/etc/users/admin/search/local (worked)

The only field extraction I have working is from conf files local to the indexer. Am I making a simple mistake?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

All search-time extractions must be defined on the search head (which appears to be the same as the indexer in your case).

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

All search-time extractions must be defined on the search head (which appears to be the same as the indexer in your case).

gkanapathy
Splunk Employee
Splunk Employee

The article about "where do I configure my settings" is fairly explicit about which settings are search-time (and therefore on the search head) and which are input-time or parse-time. If you don't know specifically that you should use a heavy forwarder, then you should use a light forwarder.

0 Karma

jhedgpeth
Path Finder

Thanks for responding. You're right about the indexer/search combo. Since I'm preparing this for my users and I already know the data, I was trying to config this ahead of time (which I thought was non-search-time), or is there only "search-time" extraction? On the other point, do you know where I'd find info to make an educated choice about light/heavy forwarders? My main factor now was that I'm configuring not to forward GBs of data that I can't afford. thanks!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Also, unless you have a good specific reason for doing otherwise, it's recommended that you use light forwarders rather than heavy.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...