Splunk Search

The bug of fields extraction in Splunk Web

Path Finder

Hi, Splunkers:

I found a bug of fields extraction in Splunk Web like following picture:
alt text
As you can see, I was extract the v2ray_access_method which has the value : "tcp" OR "", and the next field is v2ray_access_ip.
When I click the tag "v2ray_access_method" after "Events", there will be only shows "tcp" in the list but there are some IP shows in blue in the tag "Event". So I think maybe there is a bug in the fields extractor fuctions.

0 Karma

Esteemed Legend

When you post a question, if you choose to use images, ALSO POST TEXT. We need the search SPL, sample log events, etc. I for one, am done transposing pictures.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!