Field extraction failing

[grantccarlson]

Hello,

I have input data that has a field named "tag" and Splunk is not extracting this field correctly. Any suggestions are appreciated!

[vik_splunk]

You are likely going to run into an issue of having a "reserved" field name like tag, eventtype etc. where the extracted field tag is possibly going to be confused with Splunk tags. The suggestion would be to rename field at the source csv or have an explicit field extraction to help you.

This might help : https://answers.splunk.com/answers/659101/is-there-a-list-of-unusable-field-names.html

[woodcock]

I suggest you update your post with WAAAAAAAAAAAAAAAAAAAAAY more detail.

[grantccarlson]

What sort of detail do you need?

[woodcock]

A complete do-over. What is your search SPL? What is your expected output? If your data has a field named "tag", then why do I not see any evidence of this (I guess this is what you are saying is the problem)? What is the field extraction (from props.conf) that is supposed to create this field? Where in one of your sample raw events is the portion of the event that makes up the value for its tag field.

[somesoni2]

Which column of your csv data is field tag?? Could you share your configuration for field extraction (or sourcetype parsing)?

[grantccarlson]

The "tag" field is the last field in the data.

Time,src_user,recipient,subject,file_name,tag
4/1/19 10:00,Ty,George,Memo,Virus,email
4/2/19 10:00,George,James,Please see!, ,email
4/3/19 10:00,Mark,Josephine Daakjy,Memo,Memo,email

Here are the first 3 rows of the data. I have removed last names to make the data anonymous.

[somesoni2]

What's the sourcetype that you've assigned to this sourcetype? Have you configured anything for the CSV field extraction?

[grantccarlson]

The source type is CSV. I did go through the field extractions -> delimiter to try to rename and extract all the fields. So far I am not having any luck with that process either.

[grantccarlson]

I also tried to extract the fields via the "+Extract New Fields" option at the bottom on the fields list in the UI, but this also does not work.