I have a long event which I tried to extract fields from, using splunk's extract additional fields feature.
I chose comma delimited extraction and named the fields appropriately. I have 117 fields altogether and when I to display the fields with the table command, I noticed that there are a couple of data-to-field mismatches.
field3 value is replicated for field5.
field4 value is replicated for field8.
Please refer the screenshot for better understanding:
I have checked the transforms.conf and that looks fine.
I'm not sure how to get over this issue.
Any help in guiding towards the right solution will be highly appreciated.
