topic Why is Extracted field not searchable? in Splunk Search

Why is Extracted field not searchable?

oliverja — Mon, 27 Jun 2022 15:15:53 GMT

I have logs that seem to be extracting perfectly. All fields show up in "Interesting Fields", and each one can be searched (myField=*) gives results.

EXCEPT:

I have a field called "domain". It cannot be searched. It is there. It shows 100% of events have it. I hover over it and i see the contents. But when I run a search, nada.

index=disa-cbii

index=disa-cbii domain="insight.adsrvr.org"

0 Results found.

Same for domain=*

Now, if we throw in spath

index=disa-cbii | spath domain | search domain="insight.adsrvr.org"

we get plenty of results.

What is happening? From everything i can tell, I should not need spath because the event is extracting just fine. All the other dozen fields are extracted and searchable.

index=disa-cbii | table domain

works fine. How can I table something that doesn't exist?

Re: Extracted field is not searchable

gcusello — Mon, 27 Jun 2022 08:44:09 GMT

Hi @oliverja,

if you said the using the spath command you see the data, I suppose that you're speaking of json format, did you used the INDEXED_EXTRACTION=JSON in your props.conf?

Ciao.

Giuseppe

Re: Extracted field is not searchable

oliverja — Mon, 27 Jun 2022 09:13:37 GMT

I have "KV_MODE = json" in my props.conf, which I took to mean that my extractions could take place at search time, instead of index time.

If I do your solution, I would need to disable the KV_MODE so that it is not doing the same work twice? But it would be done on the ingest/index side, not search. We get a lot of these, and I am worried about the storage implications.

I also want to add -- "domain" shows up as covering 100% of events. Again implying it is working?

Re: Extracted field is not searchable

oliverja — Wed, 06 Jul 2022 05:07:06 GMT

Any more clarification before I start overriding things?

Re: Extracted field is not searchable

gcusello — Wed, 06 Jul 2022 06:33:11 GMT

Hi @oliverja,

as I said, I usually use INDEXED_EXTRACTIONS = JSON and it always correctly runs but kv_mode = json should still work.

Anyway, if the problem is only on one field (domain) maybe the easiest solution is to add a regex extraction on ly for this field, to avoid to change all your extractions.

Ciao.

giuseppe