When displaying the datamodel in search results, auto-extracted fields are not extracted properly for some events?

[Shubhanker99]

Hello Splunk Community,

I am facing this issue and was hoping if anyone could help me:

In the Splunk datamodel, for the auto-extracted fields, there are some events whose fields are not being extracted. Majority of the events have their fields extracted but there are some 10-15 events whose fields are not being extracted properly.

Any suggestions/ideas as to what is causing this discrepancy?

Thanks!

[Cvlcceo]

• How do I fix unknown values in a data model search?

[VatsalJagani]

@Cvlcceo - It's a field extraction issue and not a data-model issue. Kindly please fix the issue with field extraction or data.

[VatsalJagani]

@Shubhanker99 - It's possible as data-model solely relies on the events and their extraction.

For example, if I'm having data in which IPs are present and I'm extracting the field src_ip, but then I have some events where IP is not present then src_ip field will not be present in the data-model as well.

What you should do:

• Check whether your 10-15 events that are missing those fields can extract those fields or not. (You can use your data-models base search to find out those events.)
  • If it can, then fix the field extraction so they also extract the field.
  • If not, then you can make it a calculated field in the data-model and write eval that looks something like this.
    • if(isnull(action), "unknown", action)
    • Here in this example for any event which does not extract the action field, you will be replacing the value with "unknown".

I hope this helps!!!

[Shubhanker99]

@VatsalJagani thanks for the comment. The 10-15 events whose fields are not being extracted properly also have those said fields. Right now I am using eval expressions to extract the important fields which are not being extracted but I wanted to know the root cause of why those fields are not being extracted, just to know in what cases the fields might not be extracted and prepare other plans for those cases.

[VatsalJagani]

@Shubhanker99 - There could be hundreds of reasons why a field is not being extracted. But it depends on mainly two things that you need to check:

• What extractions configuration do you have (in props.conf & transforms.conf)
• What are the events for which it is working and what are the events for which it is not working

By looking at these two, you should be able to identify what is wrong with the extraction configuration.