Splunk Search

Is there a way to not do expansion of sourcetype?

fredclown
Contributor

I execute a search with this ...

 

index=foo sourcetype=wineventlog field=value ...

 

In the search.log I am seeing a line that says ...

 

INFO  SearchEvaluatorBasedExpander -  sourcetype expansions took 32 ms

 

and after that I see ...

 

INFO  UnifiedSearch - Expanded index search = (index=foo sourcetype=wineventlog OR sourcetype=WinEventLog:Application OR sourcetype=WinEventLog:DFS-Replication OR sourcetype=WinEventLog:DNS-Server OR sourcetype=WinEventLog:Directory-Service OR sourcetype=WinEventLog:File-Replication-Service OR sourcetype=WinEventLog:Key-Management-Service ...

 

Is there a way to not do expansion of sourcetype? It still works, but it is encompassing more data than needs to be searched over and is inefficient.

Labels (1)
0 Karma

fredclown
Contributor

It looks to me like it has to do with field aliases. Which is odd I think. The field I am using is an alias for some other fields in other sourcetypes ... but not in the sourcetype I am specifying. In that sourcetype that is indeed the field name. I could be wrong, but that is what it looks like to me. Anyone have thoughts on this? I would think that if I explicitly specify a sourcetype then that would be all that is used.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...