Splunk Search

Search does not return results for some values of one character extracted field

hmozaffari
Path Finder

I have defined an extracted field called "log_level" which holds one character values ("E","W,"I"). The definition of extracted field is fine and Splunk correctly identify them, group them and show the counts in left side summary box when I search for all events.

But when I search for certain values, even though they exist, Splunk doesn't return any result. For example log_level="E" and log_level="I" returns results but log_level="W" doesn't. I thought it might be related to popularity of those values but it doesn't. In my source 1% of records have "E" value, 9% "W" and 90% "I" value.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

You are probably running in to this well-known problem:

http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

The solution is to put this into fields.conf in the same directory that you have your field extractions (where props.conf is):

[MyField]
INDEXED_VALUE = false

View solution in original post

woodcock
Esteemed Legend

You are probably running in to this well-known problem:

http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

The solution is to put this into fields.conf in the same directory that you have your field extractions (where props.conf is):

[MyField]
INDEXED_VALUE = false

hmozaffari
Path Finder

Thanks. It resolved it!
Just a hint for others. If your extracted field name is "EXTRACT-MyField" remove the EXTRACT prefix and just refer to it as "[MyField]"

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...