topic Is there a list of unusable field names? in Splunk Search

Is there a list of unusable field names?

krisreeves — Tue, 15 May 2018 18:36:58 GMT

Note: The question is not "how do I search for a field with the name of tag", but "what other field name(s) behave like this"?

We recently ran into this case:

A user logged a message that included the text tag="some stuff"
User tried to search by that field, but gets an error like unable to find tag "some stuff"

tag appears to be a reserved word, but I was unable to find a list of any other cases like this. It's unfortunate that the tags functionality (which isn't in use) uses the same syntax as field matching here.

We'd like to add some code to warn on this kind of case, is there a list of all such keywords which, when searching keyword=foo, would not actually match the field name keyword?

Re: Is there a list of unusable field names?

HiroshiSatoh — Tue, 29 Sep 2020 19:29:12 GMT

You can search by escaping the double quotation.

index=XXX "tag=\"some stuff\""

The following are used in the basic search part.
※If there is a shortage, please someone supplement.

Internal fields
_raw, _time, _indextime, _cd

Basic default fields
host, index, linecount, punct, source, sourcetype, splunk_server, timestamp

Default datetime fields
date_hour, date_mday, date_minute, date_month, date_second, date_wday, date_year, date_zone

etc
tag,eventtype,earliest,latest

Re: Is there a list of unusable field names?

niketn — Wed, 16 May 2018 08:19:00 GMT

@krisreeves for the data that you have ingested seems like there is tag (and possibly eventtype) created.
You would need to create a Field Extraction to name the field something other than tag like Tag with uppercase T.

Re: Is there a list of unusable field names?

krisreeves — Wed, 16 May 2018 15:16:44 GMT

This is good to know! My question is, however, different: I'm looking to know which, if any, other field names behave like this so that we can avoid using them entirely

Re: Is there a list of unusable field names?

krisreeves — Thu, 17 May 2018 23:30:10 GMT

So far, beyond the default fields listed here: https://docs.splunk.com/Documentation/Splunk/7.1.0/Data/Aboutdefaultfields

There is tag and eventtype

Re: Is there a list of unusable field names?

HiroshiSatoh — Tue, 29 Sep 2020 19:34:50 GMT

The following are used in the basic search part.
※If there is a shortage, please someone supplement.

Internal fields
_raw, _time, _indextime, _cd

Basic default fields
host, index, linecount, punct, source, sourcetype, splunk_server, timestamp

Default datetime fields
date_hour, date_mday, date_minute, date_month, date_second, date_wday, date_year, date_zone

etc
tag,eventtype,earliest,latest

Re: Is there a list of unusable field names?

krisreeves — Fri, 18 May 2018 15:06:36 GMT

Ah, of course -- I should have thought about earliest and latest 🙂 If you could edit this into your answer I'd like to accept this as the answer?