Splunk Search

Why some Fields are extracted and some are not

tkadale
Path Finder

I have indexed memory log files for windows. I have done the required the configuration in props.conf and transforms.conf. but only few fields are extracted and few are not. How does it happen. Either it should extract all fields or none.
Can anybody help??
Thanks in Advance.

Tags (1)
0 Karma

dmlee
Communicator

Hi,

my suggestion is to use REGEX tool to test your extract rule first ( if you are using "EXTRACT-" or "REPORT-" to extract field).

or you can share your props.conf , transforms.conf and some sample events , we can take a look .

0 Karma

srowe
Explorer

Hi, did you ever find a resolution to this? I am experiencing the same phenomenom in splunk 5.0.1. Some fields are being extracted properly and sometimes they are not (the same fields I mean!) Very strange.

0 Karma

tkadale
Path Finder

it extract some values under _serial field, even though it is not there in transforms.conf.

0 Karma

tkadale
Path Finder

Then in transforms.conf I have mentioned the fields:
[argus_extractions_win_memory]
DELIMS=","
FIELDS = Here are around 25 fields.
Only first 10 fields are extracted.

0 Karma

tkadale
Path Finder

[win-memory]
REPORT-win-memory=argus_extractions_win_memory

0 Karma

tkadale
Path Finder

Here is my props.conf stanza's
[source::...NT_Memory...]
sourcetype = win-memory
TRANSFORMS-null= setnull

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...