Different field discovery behaviour in version 4.3.4 to 5.0

[justjosh]

I have recently upgraded from Splunk 4.3.4 to 5.0

One of my log formats is JSON formatted and contains a field with a value that contains http query parameters like this:

{"q":"?user=john&product=blah"}

In version 4.3.4, Splunk would automatically discover the query parameters user and product, but in version 5 it won't.

Does anyone know if this was an intentional change?

[the_wolverine]

We just encountered this after upgrading from 4.3.4 to 5.0.3. Our key=value data is not being auto extracted from whatever reason. Field discovery button is missing from UI. And discovery options "smart", "fast" and "verbose" do nothing to fix it.

Piping everything to autokv works -- but we'd like to know why this is no longer automatic after the upgrade.

[justjosh]

Yes, I tried all 3 discovery options - none detected the query parameters as fields.

[lguinn2]

Have you played with the discovery options "smart", "fast" and "verbose"? Does it behave differently for these fields depending on your selection?