topic Re: Search event is not providing output for fields in Splunk Search

Search event is not providing output for fields

pallavi_prabhu_ — Tue, 08 Sep 2020 09:31:43 GMT

We have created http event with below command:

http://localhost:8088/services/collector

Body:

{ "sourcetype":"trial", "event":"ITSM1", "fields": { "discription":"ITSM1 inserting data", "urgency":"High" } }

This data is visible on splunk enterprise. Now we are trying to search this event using criteria as Urgency = High . but it didn't return any event.

We tried using curl command still same result. Can you suggest what could be the issue?

C:\Users\terminal>curl -k -u username:Password https://localhost:8089/services/search/jobs -d output_mode="json" -d search="search index=main urgency=high"

{"sid":"1599554403.2242"}

C::\Users\terminal>curl -k -u username:Password :username:Password https://localhost:8089/services/search/jobs/1599554403.2242/events --get -d output_mode="json"

output:

"preview":false,

"init_offset":0,

"messages":[ ],

Re: Search event is not providing output for fields

thambisetty — Tue, 08 Sep 2020 10:57:24 GMT

you are trying to filter events with Urgency = High and you are getting 0 results, that's because fields are not extracted from the event. if the field is extracted from the event you could see same from fields window left side.Splunk fields
also same reason your search is matched with 0 results, you should also specify timerange.

-------------------------------

Give a thumps if it solves your problem.

Re: Search event is not providing output for fields

pallavi_prabhu_ — Tue, 08 Sep 2020 11:26:51 GMT

Adding screenshots for events created and search result. Fields are extracted but result is not listed.

Re: Search event is not providing output for fields

ITWhisperer — Tue, 08 Sep 2020 12:02:09 GMT

How did you add urgency=High to your search? Typing it in or selecting it from the list of values and adding it to the search?

Re: Search event is not providing output for fields

pallavi_prabhu_ — Tue, 08 Sep 2020 12:20:23 GMT

@thambisetty @ITWhisperer We tried both ways. In case of selecting search criteria from suggested drop down list also we are getting 0 results. Is there any search specific for HTTP event collector where event is created with json body provided as :

{
    "sourcetype":"trial",
    "event":"ITSM2",
    "fields":
            { "discription":"ITSM2 inserting data",
                "urgency":"Low"
            }}

Because we tried modifing above payload as :

{ "sourcetype":"trial",
     "event":
            { "discription":"ITSM2 inserting data",
                "urgency":"Low"
                 }}

In this case search works for urgency. So Do we need to handle search criteria differently if "fields" are used while creating events?

Re: Search event is not providing output for fields

thambisetty — Tue, 08 Sep 2020 12:34:08 GMT

yes, you need handle search criteria differently based on how you would like to project your results in reports or dashboards.

and also, I think you are adding sourcetype also inside the event attribute while constructing data for HTTP event collector. if you use sourcetype field separately as event then you don't see it in events but you see new field sourcetype because this is meta field.

curl -k -H "Authorization: Splunk 12345678-1234-1234-1234-1234567890AB" https://mysplunkserver.example.com:8088/services/collector/event -d '{"sourcetype": "my_sample_data", "event": "http auth ftw!"}'