Only the raw field has data.rest everything and ev... - Splunk Community

Splunk Search

I have an issue where the raw data shows up with data but when I query it, all the other fields come up as empty.

I have used a simple query"

index = syslogs "10.250.0.136" | table SYSLOG_message,SYSLOG_mne,_time,_raw

Below is what the raw field has:

2020-09-01T02:18:01+00:00 10.250.0.136 lemd[34] ERROR GET 11522622 from <ip address>:48053 failed 500 <device name> 0

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...