Splunk Search

Change In Sourcetype Format

BookerT14
Engager

Before a change was made, data was originally being sent to Splunk in the example of { %a | %b | %c | %d }. Now after a change, more data is being sent but was placed in the middle of the original order {%a | %b | %e | %f | %c | %d}. Causing a conflict in mapping the fields from before the change and after, affecting dashboard graphs etc. Any way to synchronize the two without having to reformat the order of data?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
If the fields truly are order-dependent like they appear, then someone did you a disservice by re-ordering them. Get them to put the new fields on the end.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

How about your field extraction?

is that done at index time or search time?

if it’s happening at search time, you could change your extractions.

I see %a is %a before and after so the existing fields are not changed, only new fields are added. In my opinion it will work if can change field extraction.

————————————
If this helps, give a like below.
0 Karma

BookerT14
Engager

It is done at search time unfortunately, meaning index is key here. While the order stayed the same for some fields, some fields order was changed causing conflict in extraction.

0 Karma

richgalloway
SplunkTrust
SplunkTrust
If the fields truly are order-dependent like they appear, then someone did you a disservice by re-ordering them. Get them to put the new fields on the end.
---
If this reply helps you, Karma would be appreciated.
0 Karma

BookerT14
Engager

Thank you, this is the direction I moved forward with.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...