Splunk Search

Splunk Default Fields in Data

fredclown
Path Finder

What happens during indexing if my data were to have key value pairs where the key is the same as one of the default Splunk fields? For instance, say my data looked like this...

_time="2014-01-09 12:15:15" host="myhost" source="mysource" sourcetype="mysourcetype" etc...
Tags (1)
0 Karma
1 Solution

Ayn
Legend

Nothing will happen during indexing, as fields in your raw log data are generally not extracted until at search-time. Also as somesoni2 points out, by default fields with existing values will not be overwritten by field extractions so nothing will happen at search-time either by default. The _time -> time renaming is due to the CLEAN_KEYS property in props.conf which cleans the field names to remove special characters, leading underscores etc.

View solution in original post

Ayn
Legend

Nothing will happen during indexing, as fields in your raw log data are generally not extracted until at search-time. Also as somesoni2 points out, by default fields with existing values will not be overwritten by field extractions so nothing will happen at search-time either by default. The _time -> time renaming is due to the CLEAN_KEYS property in props.conf which cleans the field names to remove special characters, leading underscores etc.

View solution in original post

somesoni2
Revered Legend

With quick test, it seems Splunk will ignore all the fields in the log file with same name as default splunk fields, except _time which will get renamed as "time"

This is the test log I used.

2014-01-09 12:15:15 _time="2014-01-09 12:15:15" host="myhost" source="mysource" sourcetype="mysourcetype" date_hour=1 date_minute=1 date_second=1 date_mday=1 date_wday=wednesday date_month=1 date_year=2014 index=test splunk_server=na
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!