Why do I no longer see certain fields being parsed in Splunk search results?

[NimrodSky]

Hi

For some reason, Splunk is not parsing data anymore - whenever I load new files or forward syslog, while I see the raw event in the search, I only get some generic fields such as - sourcetype, splunk_server, index, linecount, and _time.

Nothing was changed as far as I know - no new version, no changed configurations.

Thanks

[jplumsdaine22 · Accepted solution]

Are you by any chance searching in Fast Mode? If so you will see no field extractions. Change back to Smart Mode.

If you have the same problem then make sure your field extractions are correctly loads. Run

$SPLUNK_HOME/bin/splunk/cmd btool props list --debug

This will show you all the field extractions present and which file they are loaded from.l If you don't see yours then check where your props and transforms entries are.

[NimrodSky]

That was the issues -thanks!

[jplumsdaine22]

🙂 Fast mode gets me at least once a week