topic Re: Finding which app is doing certain field extractions in Splunk Search

Finding which app is doing certain field extractions

Narj — Mon, 28 Sep 2020 14:51:17 GMT

Hi all,

I'm doing some RADIUS stuff and notice there are a load of fields popping up that seem to be provided by another app. However, these don't appear in the Field Extractions manager menu when I show all and untick show in current app context.

Common_Error_Code
Common_Host_MAC_Address
Commmon_NAS_IP_Address
Common_Roles
etc...

I tried grepping for these in every props.conf file on the system but they don't seem to appear there at all (from $SPLUNK_HOME: find . -name "*.conf" | xargs grep -i "Common_Error_Code")

I thought these might be included with the Cisco Security app or something but can't find evidence of it at all.

Has anyone got any idea where these might be coming from?

Re: Finding which app is doing certain field extractions

gfuente — Fri, 27 Sep 2013 10:20:08 GMT

Hello there is a command to get all configuration (including fields extractions):

./splunk cmd btool props list --debug

Regards

Re: Finding which app is doing certain field extractions

Narj — Fri, 27 Sep 2013 10:41:11 GMT

Odd, none of them show up in that either. I wonder if it's some internal thing (this is an Enterprise licenced box).

Re: Finding which app is doing certain field extractions

gfuente — Fri, 27 Sep 2013 10:46:20 GMT

Splunk, by default extracts fields when it found a repeating pattern like parameter=value or parameter:value
Maybe those fields are being extracted automatically

regards

Re: Finding which app is doing certain field extractions

Narj — Fri, 27 Sep 2013 10:53:20 GMT

I'd not heard of that before!

The fields are indeed in a format like: Common.Roles=[Guest] so it seems to be substituting the . with an underscore if it's doing it automatically.

It's a bit disconcerting but I suppose ultimately useful. 🙂

Thanks!

Re: Finding which app is doing certain field extractions

gfuente — Fri, 27 Sep 2013 10:57:03 GMT

Just for reference:

At search time Splunk can automatically extract additional fields, depending on its Search Mode setting and whether or not that setting enables field discovery given the type of search being run.

http://docs.splunk.com/Documentation/Splunk/5.0.4/Knowledge/Aboutfields