Refine your search:

I'm really frustrated and need a sanity check on what I'm doing. I've got an indexer which is deploying apps to several heavy forwarders. Each app has inputs, props and transforms for specific server type data. The inputs and props are working great, however I can't get any field extraction to show up on the indexer.

One example:

props.conf ------

[stellent_log]
TRANSFORMS-stellent = stellent_setnull, stellent_keep   *(these work)*
REPORT-verbose = verbose_status
REPORT-heap = heap_status
TIME_FORMAT = %m.%d %H:%M:%S.%3N

transforms.conf ------

[verbose_status]
REGEX = Configuring tracing verbose:\s+(\w+):
FORMAT = verbose_status::$1

[heap_status]
REGEX = (?i)are\s+(?<heapfree>\d+)\s+free[^\d]+\s+(?<heaptotal>\d+)\s+meg
  • I've read http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F (may not have understood this fully)
  • Tested the regex at regexpal.com
  • Copied the transform to $SPLUNK_HOME/etc/system/local/ to see if it was in the wrong place
  • Extracted fields using the same regex from the WebUI which saved in $SPLUNK_HOME/etc/users/admin/search/local (worked)

The only field extraction I have working is from conf files local to the indexer. Am I making a simple mistake?

asked 30 Oct '10, 15:56

jhedgpeth's gravatar image

jhedgpeth
173
accept rate: 0%


One Answer:

All search-time extractions must be defined on the search head (which appears to be the same as the indexer in your case).

link

answered 30 Oct '10, 16:41

gkanapathy's gravatar image

gkanapathy ♦
26.5k1622
accept rate: 42%

Also, unless you have a good specific reason for doing otherwise, it's recommended that you use light forwarders rather than heavy.

(30 Oct '10, 16:42) gkanapathy ♦

Thanks for responding. You're right about the indexer/search combo. Since I'm preparing this for my users and I already know the data, I was trying to config this ahead of time (which I thought was non-search-time), or is there only "search-time" extraction? On the other point, do you know where I'd find info to make an educated choice about light/heavy forwarders? My main factor now was that I'm configuring not to forward GBs of data that I can't afford. thanks!

(30 Oct '10, 16:54) jhedgpeth

The article about "where do I configure my settings" is fairly explicit about which settings are search-time (and therefore on the search head) and which are input-time or parse-time. If you don't know specifically that you should use a heavy forwarder, then you should use a light forwarder.

(31 Oct '10, 06:54) gkanapathy ♦
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×407
×355
×207
×100

Asked: 30 Oct '10, 15:56

Seen: 576 times

Last updated: 30 Oct '10, 16:41

Copyright © 2005-2012 Splunk, Inc. All rights reserved.