topic Re: Stash logs in Knowledge Management

Stash logs

sara — Wed, 25 Mar 2026 14:16:10 GMT

we are unable to create further detections in ES because some key fields are missing in the stash logs. After reviewing the source logs, I found that the entity fields are marked as unknown.

We have been informed that these are internal logs, so raising a support case is not an option.

How can we identify the root cause of the missing data and determine why these fields are not being populated?

Re: Stash logs

PickleRick — Wed, 25 Mar 2026 14:31:56 GMT

What stash logs? What source logs?

Are you trying to run your detections on some summarized data?

What internal logs are you talking about?

Re: Stash logs

livehybrid — Wed, 25 Mar 2026 16:51:43 GMT

Hi @sara

Can you provide an exampe of the events which are missing fields?

Splunk Support will still usually assist where they can with issues like this if the data is being generated by your Splunk deployment, if the events missing fields are coming from outside of Splunk then I imagine we wont be able to help too much but if its generated within Splunk then support should help.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing