Why do I have empty stack fields in some logs?

[sc_admin11]

I have uploaded the screenshots of logs of same time but in one log stack and task field is empty and in one it is filled . What is the reason behind ? 
Can someone help me to figure it out?

[bowesmana]

Your stack value of ust-Dashboard-Demo-Service does not appear to be in the visible _raw data, so it is presumably a calculated, or some other kind of auto populated field, that is being generated as a result of some props/transforms. Same applies to task - that's not in the visible screenshot raw listing

If you 

| table _raw

do you see either task or stack in the data?

If not check the field settings for the sourcetype=format_v1 

[PickleRick]

It might also be an indexed field prepared by Splunk during ingestion process. It's relatively common to have additional metadata fields identifying the origin of an event in case the events themselves or the "standard" metadata (most significantly, the host value) do not provide enough information in that matter.

[sc_admin11]

hi @bowesmana 
 stack and task is not in raw data. we are passing through entrypoint.sh and input.conf file as 

[monitor:///var/log/dashboard/dashboard.log]
sourcetype = format_v1
index = dashboard
_meta = stack::<stackname> task::<taskid>

[PickleRick]

Maybe you're manipulating the _meta somewhere during the ingestion process. (do you have any transforms with DEST_KEY=_meta?

[sc_admin11]

@PickleRick  no we don't have any transforms with DEST_KEY=_meta

[bowesmana]

How are you getting stackname and taskid fields?