Splunk Search

I upgraded to 6.0 and now my field extractions don't work at all. In fact I don't get any fields extracted when I run a search from the search bar.

DerekB
Splunk Employee
Splunk Employee

I upgraded to 6.0 and now my field extractions don't work at all. In fact I don't get any fields extracted when I run a search from the search bar.

What do I do to fix this?

Tags (3)
1 Solution

Flynt
Splunk Employee
Splunk Employee

One thing to make sure of (especially if upgrading from a much earlier version of Splunk) is that you are not set to search in Fast mode -

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Changethesearchmode

Note this point especially -

Fast Mode

Disables field discovery. Field discovery is the process Splunk uses to extract fields aside from default fields such as host, source, and sourcetype. This means that Splunk only returns information on default fields and fields that are required to fulfill your search (if you are searching on certain fields, it will extract those fields).

Try searching in verbose mode and see if your extractions now appear.

View solution in original post

Flynt
Splunk Employee
Splunk Employee

One thing to make sure of (especially if upgrading from a much earlier version of Splunk) is that you are not set to search in Fast mode -

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Changethesearchmode

Note this point especially -

Fast Mode

Disables field discovery. Field discovery is the process Splunk uses to extract fields aside from default fields such as host, source, and sourcetype. This means that Splunk only returns information on default fields and fields that are required to fulfill your search (if you are searching on certain fields, it will extract those fields).

Try searching in verbose mode and see if your extractions now appear.

Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...