Splunk Search

IIS Fields Missing in Search Peer

Communicator

We setup a search peer in a master/slave scenario and noticed that not all of our fields are present in the search peer (slave) that are present in the master index.

Any idea why I can see the IIS fields in the master index, but not the search peer? We are just trying to do something basic like this (sourcetype is iis😞

index=iis cs_method=POST 

The problem is that I cannot see the cs_method field or its alias method - the only fields we see are local custom extracted fields (defined field extractions). Is this the expected behavior? Are we supposed to define all the fields we want to extract and use those instead of the interpreted fields? This could just be my lack of understanding of the index/field creation. Why isn't splunk automatically extracting the IIS fields for me on the remote peer?

Note: If I create a local field extraction it works fine. It seems the search peer isn't handling the automatic field extraction for the IIS sourcetype properly.

Could this be related to IIS auto header extraction failing?

0 Karma

Communicator

We are on the latest - 5.0.1.

0 Karma

Communicator

You may have changed the search mode which manage the data extraction If you are on Splunk 5

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Changethesearchmode

0 Karma

Communicator

What version of splunk are you using?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!