topic Re: Splunk Default Fields in Data in Splunk Search

Splunk Default Fields in Data

fredclown — Thu, 09 Jan 2014 20:18:57 GMT

What happens during indexing if my data were to have key value pairs where the key is the same as one of the default Splunk fields? For instance, say my data looked like this...

_time="2014-01-09 12:15:15" host="myhost" source="mysource" sourcetype="mysourcetype" etc...

Re: Splunk Default Fields in Data

somesoni2 — Thu, 09 Jan 2014 21:12:48 GMT

With quick test, it seems Splunk will ignore all the fields in the log file with same name as default splunk fields, except _time which will get renamed as "time"

This is the test log I used.

2014-01-09 12:15:15 _time="2014-01-09 12:15:15" host="myhost" source="mysource" sourcetype="mysourcetype" date_hour=1 date_minute=1 date_second=1 date_mday=1 date_wday=wednesday date_month=1 date_year=2014 index=test splunk_server=na

Re: Splunk Default Fields in Data

Ayn — Thu, 09 Jan 2014 21:16:52 GMT

Nothing will happen during indexing, as fields in your raw log data are generally not extracted until at search-time. Also as somesoni2 points out, by default fields with existing values will not be overwritten by field extractions so nothing will happen at search-time either by default. The _time -> time renaming is due to the CLEAN_KEYS property in props.conf which cleans the field names to remove special characters, leading underscores etc.