Splunk Search

Splunk SDK fields

ifeldshteyn
Communicator

It seems like when one queries splunk the results you get are only the default indexed fields like source or sourcetype. We do not receive any extracted results that are present in Splunk web GUI.

If there is custom field extraction called bucket_id ...

Example: sourcetype=parent bucket_id=4 will return 8 results via web GUI but none via Splunk SDK search.

If there is no custom field extraction...

Example 2: sourcetype=parent will return 42 results via web GUI and Splunk SDK will return the same 42 results.

Am I doing something wrong or does this mean I have to do custom field extraction via Splunk SDK and not via Splunk?

UPDATE:

If I grab the field extraction definition and place it directly into the search using rex then the results are found in Splunk SDK.

Example 3: sourcetype=parent | rex field=_raw ".*bucket_id=(?P\w+)" | fields bucket_id shows up just fine in Splunk SDK.

This seems rather silly. What is the point of defining extractions within splunk if they are not used while performing non-gui searches? Please tell me I am missing something.

Thanks

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you running the SDK search from the same namespace as the field extraction?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Sounds plausible - additionally, look into whether you can run searches in a specific app namespace from the SDK.

In case of the Java SDK, this is what you need: http://docs.splunk.com/DocumentationStatic/JavaSDK/1.3/com/splunk/JobArgs.html#setNamespace%28java.l...

0 Karma

ifeldshteyn
Communicator

Looks like this was a permission error. It was app-specific extraction and by changing perm to global read splunk SDK is able to see the extractions.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...