Splunk Default Fields in Data

[fredclown]

What happens during indexing if my data were to have key value pairs where the key is the same as one of the default Splunk fields? For instance, say my data looked like this...

_time="2014-01-09 12:15:15" host="myhost" source="mysource" sourcetype="mysourcetype" etc...

[Ayn · Accepted solution]

Nothing will happen during indexing, as fields in your raw log data are generally not extracted until at search-time. Also as somesoni2 points out, by default fields with existing values will not be overwritten by field extractions so nothing will happen at search-time either by default. The _time -> time renaming is due to the CLEAN_KEYS property in props.conf which cleans the field names to remove special characters, leading underscores etc.

[somesoni2]

With quick test, it seems Splunk will ignore all the fields in the log file with same name as default splunk fields, except _time which will get renamed as "time"

This is the test log I used.

2014-01-09 12:15:15 _time="2014-01-09 12:15:15" host="myhost" source="mysource" sourcetype="mysourcetype" date_hour=1 date_minute=1 date_second=1 date_mday=1 date_wday=wednesday date_month=1 date_year=2014 index=test splunk_server=na