Splunk Search

HTTP Event Collector: why my fields are not searchable?

sylim_splunk
Splunk Employee
Splunk Employee

I'm adding fields in my json format data like, below. The issue is, the search "index=myHEC *" returns data but "index=myHEC myType=Find_me " is not working.

{
"time": 1507522387,
"host": "myHostname",
"source": "mySource",
"event": {
"message": "Catch me if you can",
"severity": "INFO"
},
"fields": {
"myType": "Find_me"
}
}

Why is it happening and how can I make it work?

1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

This happens as the field, "myType" is not part of the raw data and index time field extraction is applied. By default the fields in search is extracted from raw data but this myType=Find_me is not found in raw events - that is the reason for the symptom.
To make it work for the case use fields.conf
- https://docs.splunk.com/Documentation/Splunk/latest/Admin/Fieldsconf
- http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Aboutindexedfieldextraction

i.e)
[myType]
INDEXED=true

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

This happens as the field, "myType" is not part of the raw data and index time field extraction is applied. By default the fields in search is extracted from raw data but this myType=Find_me is not found in raw events - that is the reason for the symptom.
To make it work for the case use fields.conf
- https://docs.splunk.com/Documentation/Splunk/latest/Admin/Fieldsconf
- http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Aboutindexedfieldextraction

i.e)
[myType]
INDEXED=true

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...