Splunk Search

Unable to find from where a field is being extracted

maniu1609
Path Finder

I have checked all my forwarder and indexer and search head apps. but unable to find from where a field it's extracted.

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

The field extraction can be set based on sourcetype, source OR host. So make sure you're looking for all relevant stanzas for your sourcetype/source/host. They can be extracted (EXTRACT/REPORT/TRANSFORM in props.conf) , calculated (EVAL in props.conf) OR derived (using lookups).

Do you see the value of the extracted field in your raw data?

0 Karma

FrankVl
Ultra Champion

How did you check all the apps? Manually, or by running btool?

Might be helpful if you provide a bit more info of what you are investigating...

0 Karma

p_gurav
Champion

Are you using any app or add-on for data indexing?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...