Splunk Search

IIS Fields Missing in Search Peer

slierninja
Communicator

We setup a search peer in a master/slave scenario and noticed that not all of our fields are present in the search peer (slave) that are present in the master index.

Any idea why I can see the IIS fields in the master index, but not the search peer? We are just trying to do something basic like this (sourcetype is iis😞

index=iis cs_method=POST 

The problem is that I cannot see the cs_method field or its alias method - the only fields we see are local custom extracted fields (defined field extractions). Is this the expected behavior? Are we supposed to define all the fields we want to extract and use those instead of the interpreted fields? This could just be my lack of understanding of the index/field creation. Why isn't splunk automatically extracting the IIS fields for me on the remote peer?

Note: If I create a local field extraction it works fine. It seems the search peer isn't handling the automatic field extraction for the IIS sourcetype properly.

Could this be related to IIS auto header extraction failing?

0 Karma

slierninja
Communicator

We are on the latest - 5.0.1.

0 Karma

bfernandez
Communicator

You may have changed the search mode which manage the data extraction If you are on Splunk 5

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Changethesearchmode

0 Karma

bfernandez
Communicator

What version of splunk are you using?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...