Splunk Search

Field extraction showing up for different sourcetype

Explorer

Hello. I used the Splunk field extractor to get a field from sourcetype=sourcetype_a
For some reason, when I search sourcetype=sourcetype_b, the field I extracted for sourcetype_a is showing up. The data in that field is nothing relevant as the logs are entirely different. Why is this happening, and how can I prevent it?

0 Karma
1 Solution

Champion

Is it maybe a simple key=value in the event? Those are extracted by default unless you disable it per sourcetype.

View solution in original post

Champion

Is it maybe a simple key=value in the event? Those are extracted by default unless you disable it per sourcetype.

View solution in original post

Explorer

Checking back now, you would be correct.. it's interesting though because in the event it is actually key\=value which I didn't know Splunk would pick that out. Thank you!

0 Karma

Champion

Converted to an answer.

If you consider it the correct answer, please accept it so that the question no longer looks open.

0 Karma