Splunk Search

Search does not return results for some values of one character extracted field

hmozaffari
Path Finder

I have defined an extracted field called "log_level" which holds one character values ("E","W,"I"). The definition of extracted field is fine and Splunk correctly identify them, group them and show the counts in left side summary box when I search for all events.

But when I search for certain values, even though they exist, Splunk doesn't return any result. For example log_level="E" and log_level="I" returns results but log_level="W" doesn't. I thought it might be related to popularity of those values but it doesn't. In my source 1% of records have "E" value, 9% "W" and 90% "I" value.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

You are probably running in to this well-known problem:

http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

The solution is to put this into fields.conf in the same directory that you have your field extractions (where props.conf is):

[MyField]
INDEXED_VALUE = false

View solution in original post

woodcock
Esteemed Legend

You are probably running in to this well-known problem:

http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

The solution is to put this into fields.conf in the same directory that you have your field extractions (where props.conf is):

[MyField]
INDEXED_VALUE = false

hmozaffari
Path Finder

Thanks. It resolved it!
Just a hint for others. If your extracted field name is "EXTRACT-MyField" remove the EXTRACT prefix and just refer to it as "[MyField]"

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...