Splunk Search

Problem about auto extract fields

cecilia_cheng1
Explorer

Hi Community,

I dealt with csv files before, splunk would auto extracted so many fields, shown as figure 1.

But today, when I try to search these files again, only fewer fields are displayed... shown as figure 2.

And the fields I exacted manually also didn't shown... I don't know why... Really need help~~

figure1:

Capture_fields_0.PNG

Figure 2:

Capture_fields.PNG

Thanks in advance~

BR.

Cecilia

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @cecilia_cheng1,

probably the second search was runned in Smart or Fast Mode, try in Verbose Mode and you'll have all the fields.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @cecilia_cheng1,

probably the second search was runned in Smart or Fast Mode, try in Verbose Mode and you'll have all the fields.

Ciao.

Giuseppe

cecilia_cheng1
Explorer

Hi @gcusello ,

Thank you so much for your quick response!

Yes, it worked~

BR.

Cecilia

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Remember though that running searches in verbose mode is more resource-intensive because Splunk extracts all fields regardless of whether you need them or not.

It's often enough to run your search in fast mode but use "| fields + field1 field2 ..." to include the fields in the results. (the fields used in calculations within the processing pipeline are included automaticaly if I remember correctly).

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...