Knowledge Management

Field extraction failing

grantccarlson
New Member

Hello,

I have input data that has a field named "tag" and Splunk is not extracting this field correctly. Any suggestions are appreciated!
alt text

Tags (1)
0 Karma

vik_splunk
Communicator

You are likely going to run into an issue of having a "reserved" field name like tag, eventtype etc. where the extracted field tag is possibly going to be confused with Splunk tags. The suggestion would be to rename field at the source csv or have an explicit field extraction to help you.

This might help : https://answers.splunk.com/answers/659101/is-there-a-list-of-unusable-field-names.html

0 Karma

woodcock
Esteemed Legend

I suggest you update your post with WAAAAAAAAAAAAAAAAAAAAAY more detail.

0 Karma

grantccarlson
New Member

What sort of detail do you need?

0 Karma

woodcock
Esteemed Legend

A complete do-over. What is your search SPL? What is your expected output? If your data has a field named "tag", then why do I not see any evidence of this (I guess this is what you are saying is the problem)? What is the field extraction (from props.conf) that is supposed to create this field? Where in one of your sample raw events is the portion of the event that makes up the value for its tag field.

0 Karma

somesoni2
Revered Legend

Which column of your csv data is field tag?? Could you share your configuration for field extraction (or sourcetype parsing)?

0 Karma

grantccarlson
New Member

The "tag" field is the last field in the data.

Time,src_user,recipient,subject,file_name,tag
4/1/19 10:00,Ty,George,Memo,Virus,email
4/2/19 10:00,George,James,Please see!, ,email
4/3/19 10:00,Mark,Josephine Daakjy,Memo,Memo,email

Here are the first 3 rows of the data. I have removed last names to make the data anonymous.

0 Karma

somesoni2
Revered Legend

What's the sourcetype that you've assigned to this sourcetype? Have you configured anything for the CSV field extraction?

0 Karma

grantccarlson
New Member

The source type is CSV. I did go through the field extractions -> delimiter to try to rename and extract all the fields. So far I am not having any luck with that process either.

0 Karma

grantccarlson
New Member

I also tried to extract the fields via the "+Extract New Fields" option at the bottom on the fields list in the UI, but this also does not work.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...