Splunk Search

Unable to find from where a field is being extracted

maniu1609
Path Finder

I have checked all my forwarder and indexer and search head apps. but unable to find from where a field it's extracted.

Tags (2)
0 Karma

somesoni2
Revered Legend

The field extraction can be set based on sourcetype, source OR host. So make sure you're looking for all relevant stanzas for your sourcetype/source/host. They can be extracted (EXTRACT/REPORT/TRANSFORM in props.conf) , calculated (EVAL in props.conf) OR derived (using lookups).

Do you see the value of the extracted field in your raw data?

0 Karma

FrankVl
Ultra Champion

How did you check all the apps? Manually, or by running btool?

Might be helpful if you provide a bit more info of what you are investigating...

0 Karma

p_gurav
Champion

Are you using any app or add-on for data indexing?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...