Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Why do I no longer see certain fields being parsed...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
For some reason, Splunk is not parsing data anymore - whenever I load new files or forward syslog, while I see the raw event in the search, I only get some generic fields such as - sourcetype, splunk_server, index, linecount, and _time.
Nothing was changed as far as I know - no new version, no changed configurations.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you by any chance searching in Fast Mode? If so you will see no field extractions. Change back to Smart Mode.
If you have the same problem then make sure your field extractions are correctly loads. Run
$SPLUNK_HOME/bin/splunk/cmd btool props list --debug
This will show you all the field extractions present and which file they are loaded from.l If you don't see yours then check where your props and transforms entries are.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you by any chance searching in Fast Mode? If so you will see no field extractions. Change back to Smart Mode.
If you have the same problem then make sure your field extractions are correctly loads. Run
$SPLUNK_HOME/bin/splunk/cmd btool props list --debug
This will show you all the field extractions present and which file they are loaded from.l If you don't see yours then check where your props and transforms entries are.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That was the issues -thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
🙂 Fast mode gets me at least once a week
Index This | Why did the turkey cross the road?
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Feel the Splunk Love: Real Stories from Real Customers
