Deployment Architecture

How does Field discovery work on Search heads?


I have a Splunk Search head that gets data from a Splunk Server that is indexing IIS logs. When I Query on the Indexing Server, SPlunk Autodiscovers the IIS headers which allows me to query using those headers.

Example: index=iis sc_status="404".

However, the fields aren't autodiscovered on the search head, so the same query doesn't return any results. Does anyone know how to populate the autodiscovered IIS fields on a search head?

Tags (2)
0 Karma



By default Splunk applies a property called "KV_MODE = auto" which will extract keys and values separated by an equal (=) sign. In this case it should extract "sc_status". This would occur when searches are executed from the search head and distributed to the indexers, or the search is executed directly on the indexer.

There are a few things that would disable this:

  1. Setting "KV_MODE = none" on host/source/sourcetype
  2. Field discovery switch is set to off in search view (flashtimeline)
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...