Splunk Search

Problem about auto extract fields

cecilia_cheng1
Explorer

Hi Community,

I dealt with csv files before, splunk would auto extracted so many fields, shown as figure 1.

But today, when I try to search these files again, only fewer fields are displayed... shown as figure 2.

And the fields I exacted manually also didn't shown... I don't know why... Really need help~~

figure1:

Capture_fields_0.PNG

Figure 2:

Capture_fields.PNG

Thanks in advance~

BR.

Cecilia

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @cecilia_cheng1,

probably the second search was runned in Smart or Fast Mode, try in Verbose Mode and you'll have all the fields.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @cecilia_cheng1,

probably the second search was runned in Smart or Fast Mode, try in Verbose Mode and you'll have all the fields.

Ciao.

Giuseppe

cecilia_cheng1
Explorer

Hi @gcusello ,

Thank you so much for your quick response!

Yes, it worked~

BR.

Cecilia

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Remember though that running searches in verbose mode is more resource-intensive because Splunk extracts all fields regardless of whether you need them or not.

It's often enough to run your search in fast mode but use "| fields + field1 field2 ..." to include the fields in the results. (the fields used in calculations within the processing pipeline are included automaticaly if I remember correctly).

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...