Splunk Search Log SearchOperator:kv

[pkeller]

When I use the Job Inspector to view the Search Log of a completed search, I find hundreds of entries tagged: SearchOperator:kv that seem to have absolutely nothing to do with the sourcetype or datasource of the search ...

ie: I'll see hundreds of regexes that are from EXTRACT-blah-blah ... that are explicitly for other sourcetypes. I'm concerned that I have a configuration issue. Lately we've had some complaints about search performance and I'm currently wondering why all this unrelated noise in the search log? Is Splunk actually trying to perform search time extractions for data that doesn't match the sourcetype the extraction was intended for?

[jtrujillo]

I dont feel that this question has been answered yet. @MuS suggestions may work, but doesnt help in a large environment when things need to be global.

The big question here is why is splunk trying to do sourcetype extracts on a source that has nothing to do with the sourcetype being searched?

[MuS]

This is hard to answer without any detailed knowledge of your setup. But I would start by checking for global permission of Apps and change it back to be App, next would be to check any rouge * entries in props.conf, last but not least run your searches in Fast Mode and add any needed field in the base search.

Hope this helps, even it might not be the solution

cheers, MuS

[clanier]

Hey MuS. Seems as if what I am referring to are Calculated-Fields. I have asked this [question][1], I when I do searches on a sourcetype for example syslog, search.log reflects calculated-fields from other sourcetypes. I am looking about how to deactivate these calculated-fields in searching not pertaining to them. Thanks, Cam.

https://answers.splunk.com/answers/586903/calculated-fields-automatically-included-in-search.html?mi...

[clanier]

Thanks MuS I appreciate the answer, I will investigate these areas shortly.

[clanier]

I too have this question, was hoping if any resolutions have been found. I am running into the same issue.