Why does Walklex return spaces before some of the field names, but fieldsummary does not? When I see this without field extractions causing spaces in the field names, it usually looks like "special" fields this happens to. But these fields don't seem to exist if I try to search for or using them.
Is this as simple as an output parsing bug from walklex or an indexing bug adding a space? If so,
1. Should the space be trimmed or the event be removed to get the correct results?
2. Any context on why this is happening with specific fields?
fieldsummary command with no spaces in field names:
index=indexName
| fieldsummary
| stats count by field
Example results from fieldsummary:
| field |
| host |
| source |
| sourcetype |
| timestamp |
walklex command with spaces in field names:
| walklex index=indexName type=field
| stats count by field
Example results from walklex:
| field |
| host |
| timestamp |
| host |
| timestamp |
