All Apps and Add-ons

How do I get Splunk DB Connect to recognize my custom fields?

ichea
Engager

A few weeks ago I downloaded the Trial Splunk Enterprise version and installed the Splunk DB Connect app to output my data to a SQL Server database. It is working but for some reason the custom fields I have created do not get sent to my database yet the default fields do. I tried multiple approaches and I found when I have a search containing a custom field no data will get sent. if I do a search using a default field I will get the expected results but the information from my custom fields will not populate in the DB. However, setting up the search with the custom fields does return results within the DB Connect interface. I am thinking that I need to add something like

[myField]
INDEXED = True
INDEXED_VALUE = False

to the config files but I'm new to Splunk and I'm not sure which one(s) because I can't see which file contains the defaults. Please, any thoughts or suggestions would be much appreciated. Thank you in advance.

0 Karma

kheo_splunk
Splunk Employee
Splunk Employee

If you'd like to create a custom field at search time in Splunk, props.conf is the one where you need to put proper regex.

Please start looking at http://docs.splunk.com/Documentation/Splunk/7.2.0/Knowledge/Createandmaintainsearch-timefieldextract... and check whether the field you have configured does appear on "INTERESTING FIELDS" pane on the left side in Search & Reporting app.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...