topic Extracted fields are not visible in the UI i.e. from pickfields in Splunk Search

Extracted fields are not visible in the UI i.e. from pickfields

sreedhardudi — Thu, 22 Apr 2010 18:37:52 GMT

--input.conf

[monitor:///etl/issrdr/scripts/tst/splunk/input/updates.csv]
index=iss-rdr

--props.conf

[source::/etl/issrdr/scripts/tst/splunk/input/updates.csv]
CHECK_FOR_HEADER=TRUE

---updates.csv

TIME_STAMP,TRANSACTION_ID,ENTITY_NAME,ERROR_MESSAGE
2010-04-21 06:12:37,000002137520,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:13:07,000002137521,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:13:20,000002137522,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:12:37,000002137520,INSTRUMENT_COMMENT,value too large for column

Re: Extracted fields are not visible in the UI i.e. from pickfields

bwooden — Fri, 23 Apr 2010 03:38:50 GMT

An alternate solution would be to modify your props.conf & transforms.conf to explicitly specify the headers

props.conf

[source::/etl/issrdr/scripts/tst/splunk/input/updates.csv]
REPORT-fields = updateFields

transforms.conf

[updateFields]
FIELDS="TIME_STAMP","TRANSACTION_ID","ENTITY_NAME","ERROR_MESSAGE"
DELIMS=","

Re: Extracted fields are not visible in the UI i.e. from pickfields

sreedhardudi — Fri, 23 Apr 2010 14:30:46 GMT

I tried as suggested by you but still the fields are not displayed in the UI

Re: Extracted fields are not visible in the UI i.e. from pickfields

sreedhardudi — Fri, 23 Apr 2010 14:31:44 GMT

Not sure if any permissions setting is required to get this fields into the UI

Re: Extracted fields are not visible in the UI i.e. from pickfields

bwooden — Sat, 24 Apr 2010 00:19:25 GMT

You shouldn't have had to re-start Splunk as those are search time field extractions. You might try a "| evaluate reload=T" but I don't think that is the challenge.

So you're seeing the results but when you choose "Pick Fields" those fields are not listed as options?