Why are there a few fields are missing when importing data from DOORS next gen to Splunk?

[Sharmila]

Hello All,

I tried to extract data from DOORS Next Gen. After importing the data, I found that few fields are missing. 

Search I made,

index=2w_triumph_7inch_doorsnext_export
| search ModuleID=121994| chart count by "RB_Status"

"RB_Status" is also a field. But "Artifact type" field is missing in the field list, no results found when attempting to search with "Artifact type".

Similarly, when the data is empty (i.e  there are 10 empty values are in "RB_Status", it was not taken into count when chart command is given)

Thanks in ad

[ITWhisperer · Accepted solution]

The chart command uses a by clause to determine what to count by, in your case, you are counting by the values in RB_Status, i.e. you will get a count for the number of times each non-null value of RB_Status appears in your data set. This will reduce your event stream to two field, RB_Status and count. Everything else in no longer in the events. This is the way the command is supposed to work.