Splunk Search

I upgraded to 6.0 and now my field extractions don't work at all. In fact I don't get any fields extracted when I run a search from the search bar.

DerekB
Splunk Employee
Splunk Employee

I upgraded to 6.0 and now my field extractions don't work at all. In fact I don't get any fields extracted when I run a search from the search bar.

What do I do to fix this?

Tags (3)
1 Solution

Flynt
Splunk Employee
Splunk Employee

One thing to make sure of (especially if upgrading from a much earlier version of Splunk) is that you are not set to search in Fast mode -

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Changethesearchmode

Note this point especially -

Fast Mode

Disables field discovery. Field discovery is the process Splunk uses to extract fields aside from default fields such as host, source, and sourcetype. This means that Splunk only returns information on default fields and fields that are required to fulfill your search (if you are searching on certain fields, it will extract those fields).

Try searching in verbose mode and see if your extractions now appear.

View solution in original post

Flynt
Splunk Employee
Splunk Employee

One thing to make sure of (especially if upgrading from a much earlier version of Splunk) is that you are not set to search in Fast mode -

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Changethesearchmode

Note this point especially -

Fast Mode

Disables field discovery. Field discovery is the process Splunk uses to extract fields aside from default fields such as host, source, and sourcetype. This means that Splunk only returns information on default fields and fields that are required to fulfill your search (if you are searching on certain fields, it will extract those fields).

Try searching in verbose mode and see if your extractions now appear.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...