Splunk Search

Why are there a few fields are missing when importing data from DOORS next gen to Splunk?

Sharmila
Engager

Hello All,

I tried to extract data from DOORS Next Gen. After importing the data, I found that few fields are missing. 

Search I made,

index=2w_triumph_7inch_doorsnext_export
| search ModuleID=121994| chart count by "RB_Status"

"RB_Status" is also a field. But "Artifact type" field is missing in the field list, no results found when attempting to search with "Artifact type".

Similarly, when the data is empty (i.e  there are 10 empty values are in "RB_Status", it was not taken into count when chart command is given)

Thanks in ad

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The chart command uses a by clause to determine what to count by, in your case, you are counting by the values in RB_Status, i.e. you will get a count for the number of times each non-null value of RB_Status appears in your data set. This will reduce your event stream to two field, RB_Status and count. Everything else in no longer in the events. This is the way the command is supposed to work.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The chart command uses a by clause to determine what to count by, in your case, you are counting by the values in RB_Status, i.e. you will get a count for the number of times each non-null value of RB_Status appears in your data set. This will reduce your event stream to two field, RB_Status and count. Everything else in no longer in the events. This is the way the command is supposed to work.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...