Splunk Search
Highlighted

I upgraded to 6.0 and now my field extractions don't work at all. In fact I don't get any fields extracted when I run a search from the search bar.

Splunk Employee
Splunk Employee

I upgraded to 6.0 and now my field extractions don't work at all. In fact I don't get any fields extracted when I run a search from the search bar.

What do I do to fix this?

Tags (3)
Highlighted

Re: I upgraded to 6.0 and now my field extractions don't work at all. In fact I don't get any fields extracted when I run a search from the search bar.

Splunk Employee
Splunk Employee

One thing to make sure of (especially if upgrading from a much earlier version of Splunk) is that you are not set to search in Fast mode -

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Changethesearchmode

Note this point especially -

Fast Mode

Disables field discovery. Field discovery is the process Splunk uses to extract fields aside from default fields such as host, source, and sourcetype. This means that Splunk only returns information on default fields and fields that are required to fulfill your search (if you are searching on certain fields, it will extract those fields).

Try searching in verbose mode and see if your extractions now appear.

View solution in original post