Auto extracted field with kv_mode is overriding my default source and sourcetype

[llacoste]

Hi

Not sure this question has been asked before, I didn't seem to find that particular one, so here goes:

I'm using KV_MODE=json to extract fields from some events that I receive.

It's working perfectly... however I also have got a "source, host and sourcetype" field in my JSON event...which are completely overriding my default HOST, SOURCE and SOURCETYPE fields... and of course I don't want to have the ones from the JSON event but the default one. I end up being annoyed because I can't filter through source or sourcetype as it can be anything that's in the event instead of being the ones that I defined in the forwarder app...

I thought of using some renaming or so... but I think there is something much easier that I didn't think of...

Any idea please?

Thanks for your help! Have a great day splunking!

[llacoste · Accepted solution]

I found a workaround if that can help somebody in the future...

The default "original" fields: host, source and sourcetype can be used in a search with:
_host
_source
_sourcetype

If you add the "_" at the beginning, it specifies the default field from the indexer and not the new field being extracted in the event on the search head side.

This is only a workaround, still trying to find another way of changing that on the SH.

[llacoste]

No idea? anyone?

[p_gurav]

Hi,

This link may helpful for you :

https://answers.splunk.com/answers/562805/how-to-force-to-set-certain-fields-host-and-source.html

[llacoste]

Hi,

Thanks for your input, however it seems that here he is talking about indexing time. However my extraction is happening on the search head with KV_MODE=json.

So the host, sourcetype and source are right in the index, it's just when the search is being made that the json fields are being extracted and override in the left hand side my source and sourcetype. The actual data on the indexer should remain the good ones.