Getting Data In

Why can't I see any results while searching a search-time extracted field value?

mchang_splunk
Splunk Employee
Splunk Employee

I have a search-time extracted field defined in props.conf:

[foo]
EXTRACT-fields = msg=\".{20}(?<newfield>.{6})    

The sample log:

Wed Feb 27 17:12:03 EST 2019 msg="020202P032929055801 FINDME

I can see "FINDME" as a value of newfield listed in "field explorer" on UI while searching "sourcetype=foo"

When I search "sourcetype=foo newfield=FINDME", no result is found.

However, I can get results while searching:

sourcetype=foo newfield=*FINDME

How can I fix this issue?

0 Karma
1 Solution

mchang_splunk
Splunk Employee
Splunk Employee

This issue should be able to resolved by adding fields.conf on all the indexers:
fields.conf

[newfield] 
INDEXED_VALUE = *<VALUE>

It's not working if you put fields.conf on search head.

View solution in original post

0 Karma

mchang_splunk
Splunk Employee
Splunk Employee

This issue should be able to resolved by adding fields.conf on all the indexers:
fields.conf

[newfield] 
INDEXED_VALUE = *<VALUE>

It's not working if you put fields.conf on search head.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...