topic Splunk Search Log SearchOperator:kv in Splunk Search

Splunk Search Log SearchOperator:kv

pkeller — Wed, 24 May 2017 23:09:50 GMT

When I use the Job Inspector to view the Search Log of a completed search, I find hundreds of entries tagged: SearchOperator:kv that seem to have absolutely nothing to do with the sourcetype or datasource of the search ...

ie: I'll see hundreds of regexes that are from EXTRACT-blah-blah ... that are explicitly for other sourcetypes. I'm concerned that I have a configuration issue. Lately we've had some complaints about search performance and I'm currently wondering why all this unrelated noise in the search log? Is Splunk actually trying to perform search time extractions for data that doesn't match the sourcetype the extraction was intended for?

Re: Splunk Search Log SearchOperator:kv

clanier — Mon, 30 Oct 2017 21:20:25 GMT

I too have this question, was hoping if any resolutions have been found. I am running into the same issue.

Re: Splunk Search Log SearchOperator:kv

MuS — Mon, 30 Oct 2017 21:36:30 GMT

This is hard to answer without any detailed knowledge of your setup. But I would start by checking for global permission of Apps and change it back to be App, next would be to check any rouge * entries in props.conf, last but not least run your searches in Fast Mode and add any needed field in the base search.

Hope this helps, even it might not be the solution

cheers, MuS

Re: Splunk Search Log SearchOperator:kv

clanier — Tue, 31 Oct 2017 12:12:38 GMT

Thanks MuS I appreciate the answer, I will investigate these areas shortly.

Re: Splunk Search Log SearchOperator:kv

clanier — Wed, 01 Nov 2017 18:21:17 GMT

Hey MuS. Seems as if what I am referring to are Calculated-Fields. I have asked this [question][1], I when I do searches on a sourcetype for example syslog, search.log reflects calculated-fields from other sourcetypes. I am looking about how to deactivate these calculated-fields in searching not pertaining to them. Thanks, Cam.

https://answers.splunk.com/answers/586903/calculated-fields-automatically-included-in-search.html?minQuestionBodyLength=80

Re: Splunk Search Log SearchOperator:kv

jtrujillo — Fri, 10 Nov 2017 17:41:03 GMT

I dont feel that this question has been answered yet. @MuS suggestions may work, but doesnt help in a large environment when things need to be global.

The big question here is why is splunk trying to do sourcetype extracts on a source that has nothing to do with the sourcetype being searched?