Splunk Search

Finding which app is doing certain field extractions

Path Finder

Hi all,

I'm doing some RADIUS stuff and notice there are a load of fields popping up that seem to be provided by another app. However, these don't appear in the Field Extractions manager menu when I show all and untick show in current app context.

CommonErrorCode
CommonHostMACAddress
Commmon
NASIPAddress
Common_Roles
etc...

I tried grepping for these in every props.conf file on the system but they don't seem to appear there at all (from $SPLUNKHOME: find . -name "*.conf" | xargs grep -i "CommonError_Code")

I thought these might be included with the Cisco Security app or something but can't find evidence of it at all.

Has anyone got any idea where these might be coming from?

Tags (3)
1 Solution

Motivator

Hello there is a command to get all configuration (including fields extractions):

./splunk cmd btool props list --debug

Regards

View solution in original post

0 Karma

Motivator

Hello there is a command to get all configuration (including fields extractions):

./splunk cmd btool props list --debug

Regards

View solution in original post

0 Karma

Motivator

Just for reference:

At search time Splunk can automatically extract additional fields, depending on its Search Mode setting and whether or not that setting enables field discovery given the type of search being run.

http://docs.splunk.com/Documentation/Splunk/5.0.4/Knowledge/Aboutfields

0 Karma

Path Finder

I'd not heard of that before!

The fields are indeed in a format like: Common.Roles=[Guest] so it seems to be substituting the . with an underscore if it's doing it automatically.

It's a bit disconcerting but I suppose ultimately useful. 🙂

Thanks!

0 Karma

Motivator

Splunk, by default extracts fields when it found a repeating pattern like parameter=value or parameter:value
Maybe those fields are being extracted automatically

regards

0 Karma

Path Finder

Odd, none of them show up in that either. I wonder if it's some internal thing (this is an Enterprise licenced box).

0 Karma