Splunk Search

Why do I no longer see certain fields being parsed in Splunk search results?

Explorer

Hi

For some reason, Splunk is not parsing data anymore - whenever I load new files or forward syslog, while I see the raw event in the search, I only get some generic fields such as - sourcetype, splunk_server, index, linecount, and _time.

Nothing was changed as far as I know - no new version, no changed configurations.

Thanks

0 Karma
1 Solution

Influencer

Are you by any chance searching in Fast Mode? If so you will see no field extractions. Change back to Smart Mode.

If you have the same problem then make sure your field extractions are correctly loads. Run

$SPLUNK_HOME/bin/splunk/cmd btool props list --debug

This will show you all the field extractions present and which file they are loaded from.l If you don't see yours then check where your props and transforms entries are.

View solution in original post

Influencer

Are you by any chance searching in Fast Mode? If so you will see no field extractions. Change back to Smart Mode.

If you have the same problem then make sure your field extractions are correctly loads. Run

$SPLUNK_HOME/bin/splunk/cmd btool props list --debug

This will show you all the field extractions present and which file they are loaded from.l If you don't see yours then check where your props and transforms entries are.

View solution in original post

Explorer

That was the issues -thanks!

0 Karma

Influencer

🙂 Fast mode gets me at least once a week

0 Karma