Splunk SDK fields

[ifeldshteyn]

It seems like when one queries splunk the results you get are only the default indexed fields like source or sourcetype. We do not receive any extracted results that are present in Splunk web GUI.

If there is custom field extraction called bucket_id ...

Example: sourcetype=parent bucket_id=4 will return 8 results via web GUI but none via Splunk SDK search.

If there is no custom field extraction...

Example 2: sourcetype=parent will return 42 results via web GUI and Splunk SDK will return the same 42 results.

Am I doing something wrong or does this mean I have to do custom field extraction via Splunk SDK and not via Splunk?

UPDATE:

If I grab the field extraction definition and place it directly into the search using rex then the results are found in Splunk SDK.

Example 3: sourcetype=parent | rex field=_raw ".*bucket_id=(?P\w+)" | fields bucket_id shows up just fine in Splunk SDK.

This seems rather silly. What is the point of defining extractions within splunk if they are not used while performing non-gui searches? Please tell me I am missing something.

Thanks

[martin_mueller]

Are you running the SDK search from the same namespace as the field extraction?

[martin_mueller]

Sounds plausible - additionally, look into whether you can run searches in a specific app namespace from the SDK.

In case of the Java SDK, this is what you need: http://docs.splunk.com/DocumentationStatic/JavaSDK/1.3/com/splunk/JobArgs.html#setNamespace%28java.l...

[ifeldshteyn]

Looks like this was a permission error. It was app-specific extraction and by changing perm to global read splunk SDK is able to see the extractions.