After upgrading to 4.1, Field extraction is broken in the manager page, what gives?

When clicking on Field Extractions from Manager, users are greeted with an error message:
In handler 'extractions': Admin handler 'extractions' not found.
and nothing else shows up from there.

field-extraction error

asked 25 Jun '10, 19:53

Genti ♦
3.5k●1●20
accept rate: 37%

edited 25 Jun '10, 22:55

jrodman ♦
5.6k●5●14

One Answer:

oldest newest most voted

This is probably an instance of a known issue during an upgrade to 4.1.x.
What is happening is that a file is not deleted while upgrading and a broken link is still showing in Manager.
Confirm if you are seeing two links:
1 - Field Extractions
2 - Fields (and then field extractions within that link)

If so the solution is simple:
1 - do not click on field extractions to extract fields, instead use the "FIELDS" link.
2 - Go to splunk/etc/apps/search/default/data/ui/manager and delete the file data_extractions.xml

I believe you should not be able to see the "Field extractions" link anymore, and so, you will not have the issue.
In the future, you need to make your field extractions in the Fields link.

Hope this helps everyone out there!
.gz

link

answered 25 Jun '10, 19:58

Genti ♦
3.5k●1●20
accept rate: 37%

There has been at least one case where a data_extractions.xml file was located in a different location than $SPLUNK_HOME/etc/apps/search/default/data/ui/manager/ and was causing this issue.

Make sure you look for the file in the entire $SPLUNK_HOME/etc/ directory tree.

(22 Aug '10, 08:17) hexx ♦

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

field-extraction ×515
error ×199

Asked: 25 Jun '10, 19:53

Seen: 505 times

Last updated: 25 Jun '10, 22:55

After upgrading to 4.1, Field extraction is broken in the manager page, what gives?

Follow this question

Splunk Resources

Related questions