Splunk Search

Extracted fields are not visible in the UI i.e. from pickfields

sreedhardudi
New Member

--input.conf

[monitor:///etl/issrdr/scripts/tst/splunk/input/updates.csv]
index=iss-rdr

--props.conf

[source::/etl/issrdr/scripts/tst/splunk/input/updates.csv]
CHECK_FOR_HEADER=TRUE

---updates.csv

TIME_STAMP,TRANSACTION_ID,ENTITY_NAME,ERROR_MESSAGE
2010-04-21 06:12:37,000002137520,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:13:07,000002137521,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:13:20,000002137522,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:12:37,000002137520,INSTRUMENT_COMMENT,value too large for column 
Tags (1)
0 Karma

bwooden
Splunk Employee
Splunk Employee

An alternate solution would be to modify your props.conf & transforms.conf to explicitly specify the headers

props.conf

[source::/etl/issrdr/scripts/tst/splunk/input/updates.csv]
REPORT-fields = updateFields

transforms.conf

[updateFields]
FIELDS="TIME_STAMP","TRANSACTION_ID","ENTITY_NAME","ERROR_MESSAGE"
DELIMS=","
0 Karma

bwooden
Splunk Employee
Splunk Employee

You shouldn't have had to re-start Splunk as those are search time field extractions. You might try a "| evaluate reload=T" but I don't think that is the challenge.

So you're seeing the results but when you choose "Pick Fields" those fields are not listed as options?

0 Karma

sreedhardudi
New Member

Not sure if any permissions setting is required to get this fields into the UI

0 Karma

sreedhardudi
New Member

I tried as suggested by you but still the fields are not displayed in the UI

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...