Splunk Search

Problem about auto extract fields

cecilia_cheng1
Explorer

Hi Community,

I dealt with csv files before, splunk would auto extracted so many fields, shown as figure 1.

But today, when I try to search these files again, only fewer fields are displayed... shown as figure 2.

And the fields I exacted manually also didn't shown... I don't know why... Really need help~~

figure1:

Capture_fields_0.PNG

Figure 2:

Capture_fields.PNG

Thanks in advance~

BR.

Cecilia

Labels (3)
0 Karma
1 Solution

gcusello
Legend

Hi @cecilia_cheng1,

probably the second search was runned in Smart or Fast Mode, try in Verbose Mode and you'll have all the fields.

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @cecilia_cheng1,

probably the second search was runned in Smart or Fast Mode, try in Verbose Mode and you'll have all the fields.

Ciao.

Giuseppe

cecilia_cheng1
Explorer

Hi @gcusello ,

Thank you so much for your quick response!

Yes, it worked~

BR.

Cecilia

0 Karma

PickleRick
Ultra Champion

Remember though that running searches in verbose mode is more resource-intensive because Splunk extracts all fields regardless of whether you need them or not.

It's often enough to run your search in fast mode but use "| fields + field1 field2 ..." to include the fields in the results. (the fields used in calculations within the processing pipeline are included automaticaly if I remember correctly).

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...