Dashboards & Visualizations

(search time) extracted field not showing up on the table

Splunk Employee
Splunk Employee

I have a view (xml) that contains a search. Then i am performing some postprocess and listing the results in a table. Some of the fields are showing up, and one particular one is not. I noticed that this field is a search time extracted field through a props.conf.

Here is a simplified look at my xml:
   <table>
      <title>Result</title>
            <searchPostProcess>| fields _time, host, source, sourcetype, CoreID, date_mday </searchPostProcess>
   </table>

CoreID is a field that is being extracted during search time through a regex. (this shows in a regular search just fine, it just doesnt show in this particular view of mine).

Cheers!

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

Yeap.
Moreover, it is more efficient to do it that way as well. Here is the final version that actually works:

   <table>
      <title>Result</title>
      <fields>_time, host, source, sourcetype, CoreID, date_mday</fields>
            <searchPostProcess></searchPostProcess>
   </table>

If there are any other postprocess transformation that you wish to do you can continue to do them.

View solution in original post

Splunk Employee
Splunk Employee

Yeap.
Moreover, it is more efficient to do it that way as well. Here is the final version that actually works:

   <table>
      <title>Result</title>
      <fields>_time, host, source, sourcetype, CoreID, date_mday</fields>
            <searchPostProcess></searchPostProcess>
   </table>

If there are any other postprocess transformation that you wish to do you can continue to do them.

View solution in original post

Splunk Employee
Splunk Employee

If a field is not referenced in the main search, it is likely to be discarded from the results. This is a normal Splunk search optimization. However, since it's gone from the original search results, your postprocess will not be able to use it. You could add a fields command to the original to ensure it keeps any fields you really want later.