Trying to find where a field was created that appears in a search against our BlueCoat proxy logs.
The field is ssupplierip. I have searched all of our indexers, heavy and light forwarders, and search heads using
grep -r "s_supplier_ip". hoping the string was in a conf file somewhere, with no luck. All other fields that appear in the search output are in the forwarder distributed app on the Forwarders in transforms and props.conf, but ssupplierip shows up nowhere.
Why is this important? I need to know what logic was used to correlate the field ssupplierip with the IP's it has mapped to. I assumed that this mapping would be found in a conf files "somewhere" on one of our Splunk instances. Am I missing something obvious?
Thanks in advance
Apologies if not enough clarity, and thanks for the response.
This is already known, since ssupplierip shows up only when searching within the 'bluecoat' index. The real question is: Where is the "rule" (regex, query, other magic) that identifies the interesting content that populates the field ssupplierip? I can find all of the Bluecoat fields that show up in the query identified in props.conf and transforms.conf EXCEPT ssupplierip.
The initial collection point is a Heavy Forwarder and yes, the Blue Coat add-on is used. Searched through the Blue Coat directories specifically, and found no reference of ssupplierip. Just downloaded the App from SplunkBase and searched through the tgz contents as well. No reference.
Anybody else out there capturing Blue Coat logs have an event field of "ssupplierip?
To refocus, what I am really looking for is: Where else in a heavily distributed Splunk environment could this setting be located, since I have grep'd all servers starting @ ../splunk/etc for ssupplierip (heavy forwarders, indexers, search heads, management svrs)
redacted screenshot @ https://goo.gl/dkUhQ6
No, it does not appear in the raw data. Just to make sure, I executed a search, and exported the raw data. Not there. Also, I can specify the "field" of "ssupplierip" in a table and the output is presented as expected.