Hello
I am having some pretty weird issues with field extraction on 6.2. When I perform this search:
65932
It returns 1,668 events, which is perfectly fine - as well as about 34 fields. It also returns three sourcetypes. It doesn't return all the fields I want however, so I run this search:
65932 (sourcetype="wa_contacts" OR sourcetype="wa_messages" OR sourcetype="contacts_data")
It then returns the same 1,668 events, however, this time there are signifcantly more fields - about 50 of them. Why is this happening?
Thanks for any help.
Perhaps the extractions changed due to some smart mode changes.I would start by trying to change search mode to verbose, adding "FIELDNAME=*" or specifying fields to gather more info.
One of your sourcetypes is associated to either a builtin recognized sourcetype, or you have a TA that is extracting those fields for one of your source types.
Perhaps the extractions changed due to some smart mode changes.I would start by trying to change search mode to verbose, adding "FIELDNAME=*" or specifying fields to gather more info.
Hi
Thanks for the help.
@chanfoli: No, changing the search to verbose mode does not help - the results are the same. Adding FIELDNAME=* does not help either. This is because the search, whether in verbose or smart mode, does not extract the fields in the first place.
@esix_splunk: Perhaps - some of the sourcetypes are CSV files, perhaps its associated to a built-in CSV sourcetype. Could this be the case? I don't believe I have any TAs installed on my Splunk installation.
I believe that the following issue is related to this matter.
When I perform this search
(sourcetype="wa_messages" OR sourcetype="sms")
I get 42 fields. However, if I add one more sourcetype to this search, I get less fields (34 of them). This is causing issues with finding relevant data. Is there any way to solve this?
thanks