Field is extracted by default, but no results based on it's values?

[fishmong3r]

Returns thousands of entries:

index=myindex sourcetype=mysourcetype

Returns all (8 atm) uuid values and all starts with '211d'

index=myindex sourcetype=mysourcetype | table uuid | dedup uuid

211d644bc2

211d788fa3

211d520cc2

etc.

These returns nothing. 0 matches found for the same time period as the previous two queries:

index=myindex sourcetype=mysourcetype uuid=211d*

index=myindex sourcetype=mysourcetype uuid="211d*"

index=myindex sourcetype=mysourcetype uuid=211d%

index=myindex sourcetype=mysourcetype uuid="211d%"

Why is this? Is it an indexing issue?

[PickleRick]

How is that field extracted?

[fishmong3r]

I don't know, but it is there among the fields by default.

[PickleRick]

Can you give us an example of an event containing that field?

[fishmong3r]

I hope I cleaned it up well enough. 🙂

 

[PickleRick]

Yeah, you cleaned it to the point that it's missing the most important thing I wanted to see. If the extracted field is not bound by breakers (like in taken from the middle of the word), it will not be easily searchable (or at least not very quickly) due to how splunk works. If you see the job log, you'll see the LISPY search that is sent to indexer(s). It describes exactly what the indexer(s) will be looking for. So in case of your condition splunk will be searching all events that have "uuid<something>" indexed as a separate term and then it will try to "fit" it into the field definition. If your field is extracted from the middle of a string (like from "mynameisuuid23452" you extract everything after the "mynameis" part), splunk won't find it from such a simple search because it's not indexed as a term.

[fishmong3r]

So, I can confirm that it's not extracted from a string. This uuid is sort of an API key that is sent separately as a standalone http header.

[PickleRick]

You mean that it's not included in the _raw message but is stored in an additional indexed field only?