Splunk Cloud Platform

What would cause a single json attribute to not be extracted while all others are?

smahoney
Explorer

Recently I noticed that an important field is not being auto extracted with the _json sourcetype while all other attributes are still being extracted as fields just fine.  In the example below, the Properties.CorrelationId is not available and attempting to run stats on it produces no results.  This has always worked, what would cause this?  

 

 

{
   "Level":"Error",
   "MessageTemplate":"SPC Fulfillment controller has reported an error with message: [{httpResponseMessage}], code: [{httpResponseCode}] and status code [{httpResponseStatusCode}]",
   "RenderedMessage":"SPC Fulfillment controller has reported an error with message: [\"Server will not process, error in request. SKU not found [1105716399999].\"], code: [\"015-002-017\"] and status code [400]",
   "Properties":{
      "httpResponseMessage":"Server will not process, error in request. SKU not found [1105716399999].",
      "httpResponseCode":"015-002-017",
      "httpResponseStatusCode":400,
      "EndpointVersion":"v2",
      "SourceContext":"SPC.Services.Fulfillment.API.Controllers.OrdersController",
      "ApplicationName":"fabric:/spc/fulfillment",
      "ApplicationTypeName":"SPC.Services.Fulfillment",
      "CodePackageVersion":"2.81.0.2020072462946-08d393d6",
      "ServiceName":"fabric:/spc/fulfillment/API",
      "ServiceTypeName":"SPC.Services.Fulfillment.APIType",
      "InstanceId":132406486505333708,
      "PartitionId":"898c1f6a-ab4e-4c96-81f4-da999f2eb0f1",
      "ServiceManifestVersion":"2.81.0.2020072462946-08d393d6",
      "NodeName":"_sbp01-1FE_3",
      "CorrelationId":"abb55590-1527-f9c2-d919-8ea586f1083a",
      "Environment":"p01-1"
   }
}

 

 

Labels (2)
0 Karma
1 Solution

smahoney
Explorer

Ok, I figured this out, but its odd as hadn't seen the impact anywhere until recently.  There was a field alias that renamed an extracted correlationId to Properties.CorrelationId and the checkbox somehow got marked to overwrite field value, which was not the case earlier.  that field is now available.

View solution in original post

0 Karma

smahoney
Explorer

Ok, I figured this out, but its odd as hadn't seen the impact anywhere until recently.  There was a field alias that renamed an extracted correlationId to Properties.CorrelationId and the checkbox somehow got marked to overwrite field value, which was not the case earlier.  that field is now available.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.