I'm doing some RADIUS stuff and notice there are a load of fields popping up that seem to be provided by another app. However, these don't appear in the Field Extractions manager menu when I show all and untick show in current app context.
I tried grepping for these in every props.conf file on the system but they don't seem to appear there at all (from $SPLUNK_HOME: find . -name "*.conf" | xargs grep -i "Common_Error_Code")
I thought these might be included with the Cisco Security app or something but can't find evidence of it at all.
Has anyone got any idea where these might be coming from?
Just for reference:
At search time Splunk can automatically extract additional fields, depending on its Search Mode setting and whether or not that setting enables field discovery given the type of search being run.
I'd not heard of that before!
The fields are indeed in a format like: Common.Roles=[Guest] so it seems to be substituting the . with an underscore if it's doing it automatically.
It's a bit disconcerting but I suppose ultimately useful. 🙂
Splunk, by default extracts fields when it found a repeating pattern like parameter=value or parameter:value
Maybe those fields are being extracted automatically