Splunk Dev

Unwanted fields are being extracted for search results

MadhuS1
Explorer

I am facing this problem since very beginning. By default fields are being extracted using delimiter '='.

For eg: if an event contains symbol equals "=" in raw text, left side of it will be considered as field name and right part will be treated as field value.

Does this come with default splunk settings? If so how i can manually disable this?
How can avoid seeing these unwanted fields being extracted?

I know we can easily avoid this by All fields ==> Coverage 1% or more. But i still see fields whose coverage is 100%.

Can somebody help me with this? Thanks

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The default key-value-extraction can be turned off by setting KV_MODE = none in props.conf for that sourcetype.

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Why would you not want this?

0 Karma

MadhuS1
Explorer

When you do search for a sourcetype, it shows more than 200 fields extracted from urls.
Also it confuses users having less experience on splunk.

In my case events are properly structured and i require no more additional fields.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The default key-value-extraction can be turned off by setting KV_MODE = none in props.conf for that sourcetype.

0 Karma

MadhuS1
Explorer

Thanks martin

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...