Help with fields named EXTRA_FIELD_XX

menkurau · ‎01-28-2014

I have a lot of fields called EXTRA_FIELD_X and I am not sure why. I have not been able to find anything on Answers or Docs. I am using my first v6 UF to consume a csv file and I am wondering if I have some sort of config problem

jzhong_splunk · ‎07-31-2014

+1, I encountered the same issue for REST API call.

menkurau · ‎01-28-2014

No, and the EXTRA_FIELD_X fields contain the same values as the defined fields.

richgalloway · ‎01-28-2014

Does your CSV have more data fields than it has header fields?

---
If this reply helps you, Karma would be appreciated.

Help with fields named EXTRA_FIELD_XX

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

Help with fields named EXTRA_FIELD_XX

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Announcing Modern Navigation: A New Era of Splunk User Experience