https://community.splunk.com/t5/Getting-Data-In/Sourcetype-with-incorrect-unknown-field/m-p/467043#M80466 <P>There are several ways to do field extraction. Use <CODE>REGEX</CODE> and <CODE>FORMAT</CODE> in transforms.conf; use <CODE>EXTRACT</CODE> or <CODE>REPORT</CODE> in props.conf; use <CODE>rex</CODE> or <CODE>extract</CODE> in search.</P> Sat, 15 Feb 2020 13:17:38 GMT richgalloway 2020-02-15T13:17:38Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-with-incorrect-unknown-field/m-p/467040#M80463 <P>Hello Team,</P> <P>I am new in Splunking ,</P> <P>I need to understand few thing ,could anyone please answer the questions :</P> <P><STRONG>1.) How to make list of sourcetype and eventtype that need to be fixed to allow for proper data model<BR /> 2.) How to identify incorrect Aliased /extracted fields ?<BR /> 3.)How to Determine the sourcetype associated with incorrect /unknown fields<BR /> 4.) how to identified incorrect /unknown fields from datamodel</STRONG></P> <P>what are the steps to fix, Sorry these are common question but being new I need to create report for it !!</P> <P>Thank in Advance !!!</P> Fri, 14 Feb 2020 15:12:54 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-with-incorrect-unknown-field/m-p/467040#M80463 mailtosnsolutio 2020-02-14T15:12:54Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-with-incorrect-unknown-field/m-p/467041#M80464 <P>The CIM Validator app (<A href="https://splunkbase.splunk.com/app/2968/">https://splunkbase.splunk.com/app/2968/</A>) should help you identify what you need to correct.</P> Fri, 14 Feb 2020 18:21:16 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-with-incorrect-unknown-field/m-p/467041#M80464 richgalloway 2020-02-14T18:21:16Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-with-incorrect-unknown-field/m-p/467042#M80465 <P>Is there anyways we can do fields extraction ???</P> Fri, 14 Feb 2020 19:07:50 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-with-incorrect-unknown-field/m-p/467042#M80465 mailtosnsolutio 2020-02-14T19:07:50Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-with-incorrect-unknown-field/m-p/467043#M80466 <P>There are several ways to do field extraction. Use <CODE>REGEX</CODE> and <CODE>FORMAT</CODE> in transforms.conf; use <CODE>EXTRACT</CODE> or <CODE>REPORT</CODE> in props.conf; use <CODE>rex</CODE> or <CODE>extract</CODE> in search.</P> Sat, 15 Feb 2020 13:17:38 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-with-incorrect-unknown-field/m-p/467043#M80466 richgalloway 2020-02-15T13:17:38Z