Splunk Search
Highlighted

Extracted fields are not visible in the UI i.e. from pickfields

New Member

--input.conf

[monitor:///etl/issrdr/scripts/tst/splunk/input/updates.csv]
index=iss-rdr

--props.conf

[source::/etl/issrdr/scripts/tst/splunk/input/updates.csv]
CHECK_FOR_HEADER=TRUE

---updates.csv

TIME_STAMP,TRANSACTION_ID,ENTITY_NAME,ERROR_MESSAGE
2010-04-21 06:12:37,000002137520,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:13:07,000002137521,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:13:20,000002137522,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:12:37,000002137520,INSTRUMENT_COMMENT,value too large for column 
Tags (1)
0 Karma
Highlighted

Re: Extracted fields are not visible in the UI i.e. from pickfields

Motivator

An alternate solution would be to modify your props.conf & transforms.conf to explicitly specify the headers

props.conf

[source::/etl/issrdr/scripts/tst/splunk/input/updates.csv]
REPORT-fields = updateFields

transforms.conf

[updateFields]
FIELDS="TIME_STAMP","TRANSACTION_ID","ENTITY_NAME","ERROR_MESSAGE"
DELIMS=","
0 Karma
Highlighted

Re: Extracted fields are not visible in the UI i.e. from pickfields

New Member

I tried as suggested by you but still the fields are not displayed in the UI

0 Karma
Highlighted

Re: Extracted fields are not visible in the UI i.e. from pickfields

New Member

Not sure if any permissions setting is required to get this fields into the UI

0 Karma
Highlighted

Re: Extracted fields are not visible in the UI i.e. from pickfields

Motivator

You shouldn't have had to re-start Splunk as those are search time field extractions. You might try a "| evaluate reload=T" but I don't think that is the challenge.

So you're seeing the results but when you choose "Pick Fields" those fields are not listed as options?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.