topic Re: Field enrichment in Splunk results in Other Usage

How to achieve field enrichment in Splunk results?

Seeker — Fri, 24 Feb 2023 16:34:07 GMT

When I run a search query I see that there are some fields which are present in interesting fields but not present in the event results. How is that achieved?

Re: Field enrichment in Splunk results

gcusello — Fri, 24 Feb 2023 08:19:40 GMT

Hi @Seeker,

surely there are some field extractions or field alias or calculated fields.

See in [Settings > Fields] if there are occurrences for the sourcetype you're using.

Ciao.

Giuseppe

Re: Field enrichment in Splunk results

Seeker — Fri, 24 Feb 2023 08:52:57 GMT

I checked all three settings for fields but did not see setting related to the fields I am seeing in interesting fields. Is there any other way to enrich the search results in the background by some another process?

Re: Field enrichment in Splunk results

PickleRick — Fri, 24 Feb 2023 13:03:13 GMT

Interesting fields show all fields that are present in at least 20(? I don't remember exactly) percent of the resulting events. Maybe those events are not shown on the first page ofmthe results. Why do you say that they're not present in your events? Remember that only selected fields show in results list. To see all extracted fields you have to expand single event.

Re: Field enrichment in Splunk results

Seeker — Fri, 24 Feb 2023 13:47:32 GMT

The expanded events do not have the "Environment" field but the Interesting field has the environment field. I checked the extracted fields and could not find the Environment field being extracted.

So, my question is how would Splunk get to know the field name "Environment" and its value. Also whatever value is getting populated for "Environment" field is not present in the event. So, how this can happen? Could this be happening via Index somehow?

Re: Field enrichment in Splunk results

PickleRick — Fri, 24 Feb 2023 16:07:10 GMT

Interesting fields will show you number of occurrences next to a field name. It's really hard to believe that a field not present in (or with - there can be in some special cases some indexed fields not contained within the event data, or calculated from) the event since - by definition https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/SearchTutorial/Usefieldstosearch they must be present in 20% of results to be shown.

Re: Field enrichment in Splunk results

gcusello — Fri, 24 Feb 2023 22:25:07 GMT

Hi @Seeker,

I forgot that there are also automatic lookup that gives you more fields.

Anyway, in intersting fields (as @PickleRick said) as sgown only fields with more than 20% of results, to see all fields you have to choose the All field option.

Ciao.

Giuseppe

Re: Field enrichment in Splunk results

Seeker — Sat, 25 Feb 2023 15:19:20 GMT

Got it. I see it's working now. The magic was created by an "Automatic Lookup". It's hidden in the settings and I never knew it was enriching the search results silently.

Thanks for sharing multiple helpful "what it could be" @PickleRick @gcusello and also helping with the exact solution.