Splunk Search

The bug of fields extraction in Splunk Web

aojie654
Path Finder

Hi, Splunkers:

I found a bug of fields extraction in Splunk Web like following picture:
alt text
As you can see, I was extract the v2ray_access_method which has the value : "tcp" OR "", and the next field is v2ray_access_ip.
When I click the tag "v2ray_access_method" after "Events", there will be only shows "tcp" in the list but there are some IP shows in blue in the tag "Event". So I think maybe there is a bug in the fields extractor fuctions.

0 Karma

woodcock
Esteemed Legend

When you post a question, if you choose to use images, ALSO POST TEXT. We need the search SPL, sample log events, etc. I for one, am done transposing pictures.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.