topic Problem with field extraction in Splunk Search

Problem with field extraction

nyp_kwyc — Mon, 28 Sep 2020 18:48:27 GMT

Hello

I am having some pretty weird issues with field extraction on 6.2. When I perform this search:

65932

It returns 1,668 events, which is perfectly fine - as well as about 34 fields. It also returns three sourcetypes. It doesn't return all the fields I want however, so I run this search:

65932 (sourcetype="wa_contacts" OR sourcetype="wa_messages" OR sourcetype="contacts_data")

It then returns the same 1,668 events, however, this time there are signifcantly more fields - about 50 of them. Why is this happening?

Thanks for any help.

Re: Problem with field extraction

chanfoli — Fri, 30 Jan 2015 03:31:29 GMT

Perhaps the extractions changed due to some smart mode changes.I would start by trying to change search mode to verbose, adding "FIELDNAME=*" or specifying fields to gather more info.

Re: Problem with field extraction

esix_splunk — Fri, 30 Jan 2015 03:58:09 GMT

One of your sourcetypes is associated to either a builtin recognized sourcetype, or you have a TA that is extracting those fields for one of your source types.

Re: Problem with field extraction

nyp_kwyc — Mon, 02 Feb 2015 01:07:43 GMT

Thanks for the help.

@chanfoli: No, changing the search to verbose mode does not help - the results are the same. Adding FIELDNAME=* does not help either. This is because the search, whether in verbose or smart mode, does not extract the fields in the first place.

@esix_splunk: Perhaps - some of the sourcetypes are CSV files, perhaps its associated to a built-in CSV sourcetype. Could this be the case? I don't believe I have any TAs installed on my Splunk installation.

I believe that the following issue is related to this matter.

When I perform this search

(sourcetype="wa_messages" OR sourcetype="sms")

I get 42 fields. However, if I add one more sourcetype to this search, I get less fields (34 of them). This is causing issues with finding relevant data. Is there any way to solve this?

thanks