Splunk Search

Why does Walklex return spaces before some of the field names, but fieldsummary does not?

Derson
Explorer

Why does Walklex return spaces before some of the field names, but fieldsummary does not? When I see this without field extractions causing spaces in the field names, it usually looks like "special" fields this happens to. But these fields don't seem to exist if I try to search for or using them.

Is this as simple as an output parsing bug from walklex or an indexing bug adding a space? If so, 
1. Should the space be trimmed or the event be removed to get the correct results?
2. Any context on why this is happening with specific fields?

fieldsummary command with no spaces in field names:

 

index=indexName
| fieldsummary
| stats count by field

 

Example results from fieldsummary:

field
host
source
sourcetype
timestamp


walklex command with spaces in field names:

 

| walklex index=indexName type=field
| stats count by field

 

Example results from walklex:

field
 host
 timestamp
host
timestamp



Labels (1)
Tags (2)
0 Karma

rderson
Engager

Splunk stores everything in lower case, but fields are case sensitive. You'll notice that all the fields returned by Walklex that have a space at the start return with the correct case. Walklex is revealing the hidden backend way that Splunk stores case-sensitive field names. 

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...