topic Field extraction failing in Knowledge Management

Field extraction failing

grantccarlson — Tue, 23 Apr 2019 17:48:58 GMT

Hello,

I have input data that has a field named "tag" and Splunk is not extracting this field correctly. Any suggestions are appreciated!

Re: Field extraction failing

somesoni2 — Tue, 23 Apr 2019 18:42:38 GMT

Which column of your csv data is field tag?? Could you share your configuration for field extraction (or sourcetype parsing)?

Re: Field extraction failing

grantccarlson — Wed, 30 Sep 2020 00:13:47 GMT

The "tag" field is the last field in the data.

Time,src_user,recipient,subject,file_name,tag
4/1/19 10:00,Ty,George,Memo,Virus,email
4/2/19 10:00,George,James,Please see!, ,email
4/3/19 10:00,Mark,Josephine Daakjy,Memo,Memo,email

Here are the first 3 rows of the data. I have removed last names to make the data anonymous.

Re: Field extraction failing

somesoni2 — Tue, 23 Apr 2019 19:36:20 GMT

What's the sourcetype that you've assigned to this sourcetype? Have you configured anything for the CSV field extraction?

Re: Field extraction failing

grantccarlson — Tue, 23 Apr 2019 19:53:21 GMT

The source type is CSV. I did go through the field extractions -> delimiter to try to rename and extract all the fields. So far I am not having any luck with that process either.

Re: Field extraction failing

grantccarlson — Tue, 23 Apr 2019 20:41:47 GMT

I also tried to extract the fields via the "+Extract New Fields" option at the bottom on the fields list in the UI, but this also does not work.

Re: Field extraction failing

woodcock — Wed, 24 Apr 2019 01:27:45 GMT

I suggest you update your post with WAAAAAAAAAAAAAAAAAAAAAY more detail.

Re: Field extraction failing

grantccarlson — Wed, 24 Apr 2019 02:38:40 GMT

What sort of detail do you need?

Re: Field extraction failing

woodcock — Wed, 24 Apr 2019 06:45:51 GMT

A complete do-over. What is your search SPL? What is your expected output? If your data has a field named "tag", then why do I not see any evidence of this (I guess this is what you are saying is the problem)? What is the field extraction (from props.conf) that is supposed to create this field? Where in one of your sample raw events is the portion of the event that makes up the value for its tag field.

Re: Field extraction failing

vik_splunk — Wed, 24 Apr 2019 07:52:54 GMT

You are likely going to run into an issue of having a "reserved" field name like tag, eventtype etc. where the extracted field tag is possibly going to be confused with Splunk tags. The suggestion would be to rename field at the source csv or have an explicit field extraction to help you.

This might help : https://answers.splunk.com/answers/659101/is-there-a-list-of-unusable-field-names.html