Splunk Search

Auto extracted field with kv_mode is overriding my default source and sourcetype

llacoste
Path Finder

Hi

Not sure this question has been asked before, I didn't seem to find that particular one, so here goes:

I'm using KV_MODE=json to extract fields from some events that I receive.

It's working perfectly... however I also have got a "source, host and sourcetype" field in my JSON event...which are completely overriding my default HOST, SOURCE and SOURCETYPE fields... and of course I don't want to have the ones from the JSON event but the default one. I end up being annoyed because I can't filter through source or sourcetype as it can be anything that's in the event instead of being the ones that I defined in the forwarder app...

I thought of using some renaming or so... but I think there is something much easier that I didn't think of...

Any idea please?

Thanks for your help! Have a great day splunking!

0 Karma
1 Solution

llacoste
Path Finder

I found a workaround if that can help somebody in the future...

The default "original" fields: host, source and sourcetype can be used in a search with:
_host
_source
_sourcetype

If you add the "_" at the beginning, it specifies the default field from the indexer and not the new field being extracted in the event on the search head side.

This is only a workaround, still trying to find another way of changing that on the SH.

View solution in original post

0 Karma

llacoste
Path Finder

I found a workaround if that can help somebody in the future...

The default "original" fields: host, source and sourcetype can be used in a search with:
_host
_source
_sourcetype

If you add the "_" at the beginning, it specifies the default field from the indexer and not the new field being extracted in the event on the search head side.

This is only a workaround, still trying to find another way of changing that on the SH.

0 Karma

llacoste
Path Finder

No idea? anyone?

0 Karma

p_gurav
Champion
0 Karma

llacoste
Path Finder

Hi,

Thanks for your input, however it seems that here he is talking about indexing time. However my extraction is happening on the search head with KV_MODE=json.

So the host, sourcetype and source are right in the index, it's just when the search is being made that the json fields are being extracted and override in the left hand side my source and sourcetype. The actual data on the indexer should remain the good ones.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...