topic Re: Why some Fields are extracted and some are not in Splunk Search

Why some Fields are extracted and some are not

tkadale — Fri, 27 May 2011 05:43:55 GMT

I have indexed memory log files for windows. I have done the required the configuration in props.conf and transforms.conf. but only few fields are extracted and few are not. How does it happen. Either it should extract all fields or none.
Can anybody help??
Thanks in Advance.

Re: Why some Fields are extracted and some are not

dmlee — Fri, 27 May 2011 09:44:14 GMT

Hi,

my suggestion is to use REGEX tool to test your extract rule first ( if you are using "EXTRACT-" or "REPORT-" to extract field).

or you can share your props.conf , transforms.conf and some sample events , we can take a look .

Re: Why some Fields are extracted and some are not

tkadale — Mon, 28 Sep 2020 09:37:18 GMT

Here is my props.conf stanza's
[source::...NT_Memory...]
sourcetype = win-memory
TRANSFORMS-null= setnull

Re: Why some Fields are extracted and some are not

tkadale — Mon, 28 Sep 2020 09:37:21 GMT

[win-memory]
REPORT-win-memory=argus_extractions_win_memory

Re: Why some Fields are extracted and some are not

tkadale — Mon, 28 Sep 2020 09:37:24 GMT

Then in transforms.conf I have mentioned the fields:
[argus_extractions_win_memory]
DELIMS=","
FIELDS = Here are around 25 fields.
Only first 10 fields are extracted.

Re: Why some Fields are extracted and some are not

tkadale — Tue, 31 May 2011 06:05:02 GMT

it extract some values under _serial field, even though it is not there in transforms.conf.

Re: Why some Fields are extracted and some are not

srowe — Wed, 27 Mar 2013 15:39:10 GMT

Hi, did you ever find a resolution to this? I am experiencing the same phenomenom in splunk 5.0.1. Some fields are being extracted properly and sometimes they are not (the same fields I mean!) Very strange.