Splunk Cloud Platform

What would cause a single json attribute to not be extracted while all others are?

smahoney
Explorer

Recently I noticed that an important field is not being auto extracted with the _json sourcetype while all other attributes are still being extracted as fields just fine.  In the example below, the Properties.CorrelationId is not available and attempting to run stats on it produces no results.  This has always worked, what would cause this?  

 

 

{
   "Level":"Error",
   "MessageTemplate":"SPC Fulfillment controller has reported an error with message: [{httpResponseMessage}], code: [{httpResponseCode}] and status code [{httpResponseStatusCode}]",
   "RenderedMessage":"SPC Fulfillment controller has reported an error with message: [\"Server will not process, error in request. SKU not found [1105716399999].\"], code: [\"015-002-017\"] and status code [400]",
   "Properties":{
      "httpResponseMessage":"Server will not process, error in request. SKU not found [1105716399999].",
      "httpResponseCode":"015-002-017",
      "httpResponseStatusCode":400,
      "EndpointVersion":"v2",
      "SourceContext":"SPC.Services.Fulfillment.API.Controllers.OrdersController",
      "ApplicationName":"fabric:/spc/fulfillment",
      "ApplicationTypeName":"SPC.Services.Fulfillment",
      "CodePackageVersion":"2.81.0.2020072462946-08d393d6",
      "ServiceName":"fabric:/spc/fulfillment/API",
      "ServiceTypeName":"SPC.Services.Fulfillment.APIType",
      "InstanceId":132406486505333708,
      "PartitionId":"898c1f6a-ab4e-4c96-81f4-da999f2eb0f1",
      "ServiceManifestVersion":"2.81.0.2020072462946-08d393d6",
      "NodeName":"_sbp01-1FE_3",
      "CorrelationId":"abb55590-1527-f9c2-d919-8ea586f1083a",
      "Environment":"p01-1"
   }
}

 

 

Labels (2)
0 Karma
1 Solution

smahoney
Explorer

Ok, I figured this out, but its odd as hadn't seen the impact anywhere until recently.  There was a field alias that renamed an extracted correlationId to Properties.CorrelationId and the checkbox somehow got marked to overwrite field value, which was not the case earlier.  that field is now available.

View solution in original post

0 Karma

smahoney
Explorer

Ok, I figured this out, but its odd as hadn't seen the impact anywhere until recently.  There was a field alias that renamed an extracted correlationId to Properties.CorrelationId and the checkbox somehow got marked to overwrite field value, which was not the case earlier.  that field is now available.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>