All Apps and Add-ons

Why does DBConnect sometime index events that's lacking field value?

phamxuantung
Communicator

This happen sometime on this DB and the only one that I experience this. The view, fields and value are pretty simple, my input also. But sometime it don't index certain fields that make it difficult to make statistical report.

I checked the view and they certainly have those fields and value but the events are lacking them

phamxuantung_0-1685443028763.png

Another weird thing is some events are duplicate and some aren't. The events that are not duplicate is the one lacking fields.

phamxuantung_1-1685443260837.png

I never seen this before and don't know how to resovle this.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you certain the fields are present in the DB?  DB Connect cannot fetch what is not there.

---
If this reply helps you, Karma would be appreciated.
0 Karma

phamxuantung
Communicator

Yes, I'm certain that the fields are present in the DB, does have value and not null. In fact, it cannot fetch what I specify it to fetch although that fields have values. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check the DBX logs for messages that might explain why the fields were not extracted.  Perhaps they contain bad characters or something like that (just guessing).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...