topic Re: Change In Sourcetype Format in Splunk Search

Change In Sourcetype Format

BookerT14 — Tue, 18 Aug 2020 12:58:20 GMT

Before a change was made, data was originally being sent to Splunk in the example of { %a | %b | %c | %d }. Now after a change, more data is being sent but was placed in the middle of the original order {%a | %b | %e | %f | %c | %d}. Causing a conflict in mapping the fields from before the change and after, affecting dashboard graphs etc. Any way to synchronize the two without having to reformat the order of data?

Re: Change In Sourcetype Format

richgalloway — Tue, 18 Aug 2020 17:46:44 GMT

If the fields truly are order-dependent like they appear, then someone did you a disservice by re-ordering them. Get them to put the new fields on the end.

Re: Change In Sourcetype Format

thambisetty — Tue, 18 Aug 2020 18:27:04 GMT

How about your field extraction?

is that done at index time or search time?

if it’s happening at search time, you could change your extractions.

I see %a is %a before and after so the existing fields are not changed, only new fields are added. In my opinion it will work if can change field extraction.

Re: Change In Sourcetype Format

BookerT14 — Wed, 19 Aug 2020 16:16:42 GMT

It is done at search time unfortunately, meaning index is key here. While the order stayed the same for some fields, some fields order was changed causing conflict in extraction.

Re: Change In Sourcetype Format

BookerT14 — Wed, 19 Aug 2020 16:17:58 GMT

Thank you, this is the direction I moved forward with.