Splunk Search

Cannot search customized field ...

sunrise
Contributor

I can search by the following field key,

test_field=*

and Splunk Web displayed the lists.
Then I select the "test_field=testA"(so following keywords), but displayed no lists.

test_field=* test_field=testA

And the following search command display no result.

test_field=testA

Furthermore, I add "| search" between the two kewords, then displayed properly.

test_field=* | search test_field=testA

Why is this happened ?
Thank you for helping.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You're not telling us how your field is extracted, but I strongly suspect that what you're see is what is described here: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Basically you're likely extracting a field value that isn't part of indexed data, or only part of a token in indexed data. For instance, in the first case, the field could have been extracted in something like this manner:

[myfieldextraction]
REGEX = (matchsomething)
FORMAT = myfield::someothertext

...so the field would have the value "someothertext" even though that value doesn't actually exist at all in the index.

Or, in the second case, the extraction would look something like this:

[myotherfieldextraction]
REGEX = (matchjust)apartofaword
FORMAT = myotherfield::$1

If any of these apply to your extraction, you are very likely seeing the effects that the blog post I linked to talks about.

View solution in original post

0 Karma

Ayn
Legend

You're not telling us how your field is extracted, but I strongly suspect that what you're see is what is described here: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Basically you're likely extracting a field value that isn't part of indexed data, or only part of a token in indexed data. For instance, in the first case, the field could have been extracted in something like this manner:

[myfieldextraction]
REGEX = (matchsomething)
FORMAT = myfield::someothertext

...so the field would have the value "someothertext" even though that value doesn't actually exist at all in the index.

Or, in the second case, the extraction would look something like this:

[myotherfieldextraction]
REGEX = (matchjust)apartofaword
FORMAT = myotherfield::$1

If any of these apply to your extraction, you are very likely seeing the effects that the blog post I linked to talks about.

0 Karma

sunrise
Contributor

Thank you, Ayn.

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...