topic Re: Problem about auto extract fields in Splunk Search

Problem about auto extract fields

cecilia_cheng1 — Wed, 18 May 2022 08:17:44 GMT

Hi Community,

I dealt with csv files before, splunk would auto extracted so many fields, shown as figure 1.

But today, when I try to search these files again, only fewer fields are displayed... shown as figure 2.

And the fields I exacted manually also didn't shown... I don't know why... Really need help~~

figure1:

Figure 2:

Thanks in advance~

BR.

Cecilia

Re: Problem about auto extract fields

gcusello — Wed, 18 May 2022 08:21:49 GMT

Hi @cecilia_cheng1,

probably the second search was runned in Smart or Fast Mode, try in Verbose Mode and you'll have all the fields.

Ciao.

Giuseppe

Re: Problem about auto extract fields

cecilia_cheng1 — Wed, 18 May 2022 08:26:58 GMT

Hi @gcusello ,

Thank you so much for your quick response!

Yes, it worked~

BR.

Cecilia

Re: Problem about auto extract fields

PickleRick — Wed, 18 May 2022 09:00:57 GMT

Remember though that running searches in verbose mode is more resource-intensive because Splunk extracts all fields regardless of whether you need them or not.

It's often enough to run your search in fast mode but use "| fields + field1 field2 ..." to include the fields in the results. (the fields used in calculations within the processing pipeline are included automaticaly if I remember correctly).