Splunk Search

Search does not return results for some values of one character extracted field

hmozaffari
Path Finder

I have defined an extracted field called "log_level" which holds one character values ("E","W,"I"). The definition of extracted field is fine and Splunk correctly identify them, group them and show the counts in left side summary box when I search for all events.

But when I search for certain values, even though they exist, Splunk doesn't return any result. For example log_level="E" and log_level="I" returns results but log_level="W" doesn't. I thought it might be related to popularity of those values but it doesn't. In my source 1% of records have "E" value, 9% "W" and 90% "I" value.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

You are probably running in to this well-known problem:

http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

The solution is to put this into fields.conf in the same directory that you have your field extractions (where props.conf is):

[MyField]
INDEXED_VALUE = false

View solution in original post

woodcock
Esteemed Legend

You are probably running in to this well-known problem:

http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

The solution is to put this into fields.conf in the same directory that you have your field extractions (where props.conf is):

[MyField]
INDEXED_VALUE = false

hmozaffari
Path Finder

Thanks. It resolved it!
Just a hint for others. If your extracted field name is "EXTRACT-MyField" remove the EXTRACT prefix and just refer to it as "[MyField]"

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...