Splunk Search

Why some Fields are extracted and some are not

tkadale
Path Finder

I have indexed memory log files for windows. I have done the required the configuration in props.conf and transforms.conf. but only few fields are extracted and few are not. How does it happen. Either it should extract all fields or none.
Can anybody help??
Thanks in Advance.

Tags (1)
0 Karma

dmlee
Communicator

Hi,

my suggestion is to use REGEX tool to test your extract rule first ( if you are using "EXTRACT-" or "REPORT-" to extract field).

or you can share your props.conf , transforms.conf and some sample events , we can take a look .

0 Karma

srowe
Explorer

Hi, did you ever find a resolution to this? I am experiencing the same phenomenom in splunk 5.0.1. Some fields are being extracted properly and sometimes they are not (the same fields I mean!) Very strange.

0 Karma

tkadale
Path Finder

it extract some values under _serial field, even though it is not there in transforms.conf.

0 Karma

tkadale
Path Finder

Then in transforms.conf I have mentioned the fields:
[argus_extractions_win_memory]
DELIMS=","
FIELDS = Here are around 25 fields.
Only first 10 fields are extracted.

0 Karma

tkadale
Path Finder

[win-memory]
REPORT-win-memory=argus_extractions_win_memory

0 Karma

tkadale
Path Finder

Here is my props.conf stanza's
[source::...NT_Memory...]
sourcetype = win-memory
TRANSFORMS-null= setnull

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...