Finding which app is doing certain field extractions

[Narj]

Hi all,

I'm doing some RADIUS stuff and notice there are a load of fields popping up that seem to be provided by another app. However, these don't appear in the Field Extractions manager menu when I show all and untick show in current app context.

Common_Error_Code
Common_Host_MAC_Address
Commmon_NAS_IP_Address
Common_Roles
etc...

I tried grepping for these in every props.conf file on the system but they don't seem to appear there at all (from $SPLUNK_HOME: find . -name "*.conf" | xargs grep -i "Common_Error_Code")

I thought these might be included with the Cisco Security app or something but can't find evidence of it at all.

Has anyone got any idea where these might be coming from?

[gfuente · Accepted solution]

Hello there is a command to get all configuration (including fields extractions):

./splunk cmd btool props list --debug

Regards

[gfuente]

Just for reference:

At search time Splunk can automatically extract additional fields, depending on its Search Mode setting and whether or not that setting enables field discovery given the type of search being run.

http://docs.splunk.com/Documentation/Splunk/5.0.4/Knowledge/Aboutfields

[Narj]

I'd not heard of that before!

The fields are indeed in a format like: Common.Roles=[Guest] so it seems to be substituting the . with an underscore if it's doing it automatically.

It's a bit disconcerting but I suppose ultimately useful. 🙂

Thanks!

[gfuente]

Splunk, by default extracts fields when it found a repeating pattern like parameter=value or parameter:value
Maybe those fields are being extracted automatically

regards

[Narj]

Odd, none of them show up in that either. I wonder if it's some internal thing (this is an Enterprise licenced box).