- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How does Field discovery work on Search heads?
![richnavis richnavis](https://community.splunk.com/legacyfs/online/avatars/492837.jpg)
I have a Splunk Search head that gets data from a Splunk Server that is indexing IIS logs. When I Query on the Indexing Server, SPlunk Autodiscovers the IIS headers which allows me to query using those headers.
Example: index=iis sc_status="404".
However, the fields aren't autodiscovered on the search head, so the same query doesn't return any results. Does anyone know how to populate the autodiscovered IIS fields on a search head?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
rnavis,
By default Splunk applies a property called "KV_MODE = auto"
which will extract keys and values separated by an equal (=) sign. In this case it should extract "sc_status". This would occur when searches are executed from the search head and distributed to the indexers, or the search is executed directly on the indexer.
There are a few things that would disable this:
- Setting
"KV_MODE = none"
on host/source/sourcetype - Field discovery switch is set to off in search view (flashtimeline)
![](/skins/images/89D5ADE867CBAF0B5A525B7E23D83D7E/responsive_peak/images/icon_anonymous_message.png)