https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625739#M217501 <P>Maybe you're manipulating the _meta somewhere during the ingestion process. (do you have any transforms with DEST_KEY=_meta?</P> Tue, 03 Jan 2023 16:34:46 GMT PickleRick 2023-01-03T16:34:46Z https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625659#M217463 <P>I have uploaded the screenshots of logs of same time but in one log stack and task field is empty and in one it is filled . What is the reason behind ?&nbsp;<BR />Can someone help me to figure it out?</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-01-02 at 5.55.24 PM.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23182iEE06F1BD6C4E67BE/image-size/medium?v=v2&amp;px=400" role="button" title="Screenshot 2023-01-02 at 5.55.24 PM.png" alt="Screenshot 2023-01-02 at 5.55.24 PM.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-01-02 at 5.55.32 PM.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23181i5B930669A07BA262/image-size/medium?v=v2&amp;px=400" role="button" title="Screenshot 2023-01-02 at 5.55.32 PM.png" alt="Screenshot 2023-01-02 at 5.55.32 PM.png" /></span></P> Tue, 03 Jan 2023 16:07:40 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625659#M217463 sc_admin11 2023-01-03T16:07:40Z https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625662#M217464 <P>Your stack value of ust-Dashboard-Demo-Service does not appear to be in the visible _raw data, so it is presumably a calculated, or some other kind of auto populated field, that is being generated as a result of some props/transforms. Same applies to task - that's not in the visible screenshot raw listing</P><P>If you&nbsp;</P><LI-CODE lang="markup">| table _raw</LI-CODE><P>do you see either task or stack in the data?</P><P>If not check the field settings for the sourcetype=format_v1&nbsp;</P><P>&nbsp;</P><P>&nbsp;&nbsp;</P> Tue, 03 Jan 2023 05:08:30 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625662#M217464 bowesmana 2023-01-03T05:08:30Z https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625673#M217473 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367">@bowesmana</a>&nbsp;<BR />&nbsp;stack and task is not in raw data. we are passing through entrypoint.sh and input.conf file as&nbsp;</P><PRE>[monitor:///var/log/dashboard/dashboard.log]<BR /><SPAN>sourcetype </SPAN>= format_v1<BR /><SPAN>index </SPAN>= dashboard<BR /><SPAN>_meta </SPAN>= stack::&lt;stackname&gt; task::&lt;taskid&gt;</PRE> Tue, 03 Jan 2023 08:11:00 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625673#M217473 sc_admin11 2023-01-03T08:11:00Z https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625737#M217500 <P>It might also be an indexed field prepared by Splunk during ingestion process. It's relatively common to have additional metadata fields identifying the origin of an event in case the events themselves or the "standard" metadata (most significantly, the host value) do not provide enough information in that matter.</P> Tue, 03 Jan 2023 16:29:26 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625737#M217500 PickleRick 2023-01-03T16:29:26Z https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625739#M217501 <P>Maybe you're manipulating the _meta somewhere during the ingestion process. (do you have any transforms with DEST_KEY=_meta?</P> Tue, 03 Jan 2023 16:34:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625739#M217501 PickleRick 2023-01-03T16:34:46Z https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625781#M217514 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/231884">@PickleRick</a>&nbsp; no we don't have&nbsp;<SPAN>any transforms with DEST_KEY=_meta</SPAN></P> Wed, 04 Jan 2023 08:06:43 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/625781#M217514 sc_admin11 2023-01-04T08:06:43Z https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/626340#M217694 <P>How are you getting stackname and taskid fields?</P> Sun, 08 Jan 2023 22:10:36 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-I-have-empty-stack-fields-in-some-logs/m-p/626340#M217694 bowesmana 2023-01-08T22:10:36Z