Trace a value in Splunk / data lineage

[mihenn]

Hi,

is there a way to trace the origin of a specific value in Slunk? Currently I am trying to figure out with eventtype, lookup or eval is setting a tag and a field value for some events in Splunk. I used the btool the figure out, if the are some evals. But they do not apply. I found some lookups, but these do not contain the value I am looking for.

A code trace or data lineage function would be very helpfull sometimes.
Does anyone know a function in Splunk or an app for this?

Thank you.

[adonio]

try to find the value for the sourcetype your event / data has
then run this search:

 | rest services/saved/sourcetypes 
 | search title=<your_sourcetype>

if the list is huge, you can use the command:

 | fieldsummary

look for the resutls and itll give you all the EVAL- REPORT- etc definitions for your fields

hope it helps

[xavierashe]

Have you look in the search inspector? Drill down into the properties. Sometimes I can figure out where things came from there.

[mihenn]

I checked on that, too. That's where I found out that a lookup is used. Unfortunately not which one. Finally I found the source on the searchhead by searching all lookups with find.

It would be nice to have a mouseover in Splunk, which shows if the value is from _raw or was modified.