Getting Data In

Sourcetype with incorrect /unknown field

mailtosnsolutio
Explorer

Hello Team,

I am new in Splunking ,

I need to understand few thing ,could anyone please answer the questions :

1.) How to make list of sourcetype and eventtype that need to be fixed to allow for proper data model
2.) How to identify incorrect Aliased /extracted fields ?
3.)How to Determine the sourcetype associated with incorrect /unknown fields
4.) how to identified incorrect /unknown fields from datamodel

what are the steps to fix, Sorry these are common question but being new I need to create report for it !!

Thank in Advance !!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The CIM Validator app (https://splunkbase.splunk.com/app/2968/) should help you identify what you need to correct.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mailtosnsolutio
Explorer

Is there anyways we can do fields extraction ???

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are several ways to do field extraction. Use REGEX and FORMAT in transforms.conf; use EXTRACT or REPORT in props.conf; use rex or extract in search.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...