Splunk Search

IIS Fields Missing in Search Peer

slierninja
Communicator

We setup a search peer in a master/slave scenario and noticed that not all of our fields are present in the search peer (slave) that are present in the master index.

Any idea why I can see the IIS fields in the master index, but not the search peer? We are just trying to do something basic like this (sourcetype is iis😞

index=iis cs_method=POST 

The problem is that I cannot see the cs_method field or its alias method - the only fields we see are local custom extracted fields (defined field extractions). Is this the expected behavior? Are we supposed to define all the fields we want to extract and use those instead of the interpreted fields? This could just be my lack of understanding of the index/field creation. Why isn't splunk automatically extracting the IIS fields for me on the remote peer?

Note: If I create a local field extraction it works fine. It seems the search peer isn't handling the automatic field extraction for the IIS sourcetype properly.

Could this be related to IIS auto header extraction failing?

0 Karma

slierninja
Communicator

We are on the latest - 5.0.1.

0 Karma

bfernandez
Communicator

You may have changed the search mode which manage the data extraction If you are on Splunk 5

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Changethesearchmode

0 Karma

bfernandez
Communicator

What version of splunk are you using?

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...