topic Re: Why do I no longer see certain fields being parsed in Splunk search results? in Splunk Search

Why do I no longer see certain fields being parsed in Splunk search results?

NimrodSky — Mon, 22 Feb 2016 09:09:58 GMT

For some reason, Splunk is not parsing data anymore - whenever I load new files or forward syslog, while I see the raw event in the search, I only get some generic fields such as - sourcetype, splunk_server, index, linecount, and _time.

Nothing was changed as far as I know - no new version, no changed configurations.

Thanks

Re: Why do I no longer see certain fields being parsed in Splunk search results?

jplumsdaine22 — Mon, 22 Feb 2016 14:33:18 GMT

Are you by any chance searching in Fast Mode? If so you will see no field extractions. Change back to Smart Mode.

If you have the same problem then make sure your field extractions are correctly loads. Run

$SPLUNK_HOME/bin/splunk/cmd btool props list --debug

This will show you all the field extractions present and which file they are loaded from.l If you don't see yours then check where your props and transforms entries are.

Re: Why do I no longer see certain fields being parsed in Splunk search results?

NimrodSky — Mon, 22 Feb 2016 14:48:43 GMT

That was the issues -thanks!

Re: Why do I no longer see certain fields being parsed in Splunk search results?

jplumsdaine22 — Mon, 22 Feb 2016 16:57:01 GMT

🙂 Fast mode gets me at least once a week