topic Re: Field extractions are incomplete for juniper in All Apps and Add-ons

Field extractions are incomplete for juniper

nathanluke86 — Tue, 19 Nov 2019 09:14:42 GMT

Hello,

We are extracting juniper logs using the Juniper addon and are getting random fields as pictured.

Could someone explain why this might be happening

Re: Field extractions are incomplete for juniper

DavidHourani — Tue, 19 Nov 2019 09:52:09 GMT

Hi @nathanluke86,

Are you on a distributed env ? If so where have you installed the ad-on ?

Search time components of the TA should go on the search head to get the cleanest extractions possible.

In your case it seems that the auto-extractions are grabbing lots of weird fields and polluting your field list. In order to disable it modify your local props.conf to include KV_MODE = none that way auto-extraction will be disabled.

More info here:
https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/Automatickey-valuefieldextractionsatsearch-time#Automatic_key-value_field_extraction_format

Cheers,
David

Re: Field extractions are incomplete for juniper

nathanluke86 — Wed, 20 Nov 2019 10:00:08 GMT

Hi @DavidHourani

We are in a distributed env. I have checked props.conf and KV_MODE is set to none. The TA is installed on all forwarders and Search heads.

Thanks

Re: Field extractions are incomplete for juniper

DavidHourani — Wed, 20 Nov 2019 10:38:03 GMT

Are those fields showing over all time ? Click on one of the weird fields and check what the event looks like, wether its broken or not.

Also check if there are other places where the sourcetype might be grabbing its config from use btool to verify that.

Re: Field extractions are incomplete for juniper

nathanluke86 — Tue, 26 Nov 2019 08:13:29 GMT

The log is not complete when viewing these weird extractions

Thanks