Splunk Search

Search event is not providing output for fields

pallavi_prabhu_
Explorer

We have created http event with below command: 

Body:
{     "sourcetype":"trial",         "event":"ITSM1",         "fields":                 {                 "discription":"ITSM1 inserting data",                 "urgency":"High"                             } }
 

This data is visible on splunk enterprise. Now we are trying to search this event using criteria as Urgency = High . but it didn't return any event.

We tried using curl command still same result.  Can you suggest what could be the issue?

 

C:\Users\terminal>curl -k -u username:Password https://localhost:8089/services/search/jobs -d output_mode="json" -d search="search index=main urgency=high"

{"sid":"1599554403.2242"}

C::\Users\terminal>curl -k -u username:Password :username:Password  https://localhost:8089/services/search/jobs/1599554403.2242/events --get -d output_mode="json"

output:

   "preview":false,

   "init_offset":0,

   "messages":[ ],

Labels (2)
0 Karma
1 Solution

thambisetty
Super Champion

yes,  you need handle search criteria differently based on how you would like to project your results in reports or dashboards.

and also, I think you are adding sourcetype also inside the event attribute while constructing data for HTTP event collector. if you use sourcetype field separately as event then you don't see it in events but you see new field sourcetype because this is meta field.

curl -k -H "Authorization: Splunk 12345678-1234-1234-1234-1234567890AB" https://mysplunkserver.example.com:8088/services/collector/event -d '{"sourcetype": "my_sample_data", "event": "http auth ftw!"}'

 

 

————————————
If this helps, give a like below.

View solution in original post

pallavi_prabhu_
Explorer

Adding screenshots for events created and search result. Fields are extracted but result is not listed.event_collector data.PNGextracted_fields Urgency.PNGSearch_using Urgency.PNG

0 Karma

ITWhisperer
Legend

How did you add urgency=High to your search? Typing it in or selecting it from the list of values and adding it to the search?

0 Karma

pallavi_prabhu_
Explorer

@thambisetty  @ITWhisperer  We tried both ways. In case of selecting search criteria from suggested drop down list also we are getting 0 results. Is there any search specific for HTTP event collector where event is created with json body provided as :

{
    "sourcetype":"trial",   
    "event":"ITSM2",   
    "fields":   
            {                "discription":"ITSM2 inserting data",
                "urgency":"Low"               
            }}
 
Because we tried modifing above payload as :
{    "sourcetype":"trial",
       "event":   
            {                "discription":"ITSM2 inserting data",
                "urgency":"Low"
                           }}
 
In this case search works for urgency. So Do we need to handle search criteria differently if "fields" are used while creating events?
 
0 Karma

thambisetty
Super Champion

yes,  you need handle search criteria differently based on how you would like to project your results in reports or dashboards.

and also, I think you are adding sourcetype also inside the event attribute while constructing data for HTTP event collector. if you use sourcetype field separately as event then you don't see it in events but you see new field sourcetype because this is meta field.

curl -k -H "Authorization: Splunk 12345678-1234-1234-1234-1234567890AB" https://mysplunkserver.example.com:8088/services/collector/event -d '{"sourcetype": "my_sample_data", "event": "http auth ftw!"}'

 

 

————————————
If this helps, give a like below.

View solution in original post

thambisetty
Super Champion
  1.  you are trying to filter events with Urgency = High and you are getting 0 results, that's because fields are not extracted from the event. if the field is extracted from the event you could see same from fields window left side.Splunk fields 
  2. also same reason your search is matched with 0 results, you should also specify timerange.

-------------------------------

Give a thumps if it solves your problem.

————————————
If this helps, give a like below.
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!