Splunk® Add-on Builder

Splunk Add-on Builder User Guide

This documentation does not apply to the most recent version of Splunk® Add-on Builder. For documentation on the most recent version, go to the latest release.

Known issues

Publication date Defect number Description
2016-07-01 TAB-935 Field extraction results are not displayed for events that are longer than 10,000 characters.
2016-06-28 TAB-925 A blank page is displayed when running the Add-on Builder from an indexer cluster node.
2016-06-27 TAB-916 IE crashes if you change a delimiter while doing a field extraction.
2016-06-27 TAB-904 An empty value followed by a space corrupts the next KV pair.
2016-06-26 TAB-902 Parsing fails for sample data with the Unstructured Data format, and writes the error "KVException: Failed to POST" to the $SPLUNK_HOME/var/log/splunk/web_service.log file.


To work around this issue:

1. In the Add-on Builder, go to the Step 4: Extract Fields page and delete the results for the field extraction that produced the error.

2. In a text editor, open $SPLUNK_HOME/etc/apps/splunk_app_addon-builder/default/field_extraction_token.conf and change the value of "batch_size" to 3000.

3. Save your changes and restart Splunk Enterprise.

4. Extract fields for the sample data again.

2016-06-23 TAB-877 AUTO KV in the Add-on Builder does not support A::B:=C.
2016-06-22 TAB-736 Unstructured data is detected as a tabular format.
Last modified on 11 July, 2016
What's new   Fixed issues

This documentation applies to the following versions of Splunk® Add-on Builder: 1.1.0

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters