Splunk Search

Why splunk stop to extract new fields for some reason?

imanpoeiri
Communicator

Hi Splunkers,

I will cut the intro and talk straight to the problem:

I have 5 fields that were declared on props.conf, lets say:

[sourcetype_name]
INDEXED_EXTRACTIONS=csv
TIMESTAMP_FIELDS ="datefield"
FIELDALIAS-alias-may="field1" AS fieldA "field2" AS fieldB "field3" AS field3 "datefield" AS date_created "field5" AS fieldE

I can find field1, fieldA, field2, fieldB, datefield, field5 on the indexed fields, but not for date_created, and fieldE.

but when i move the "field3" AS field3 to the very last of the line, I can find datefield, date_created, field5, and fieldE.

I know it is not a best practice to put the same field name in the props.conf, but why splunk stop the field extraction when it hit error? I think splunk should be able to ignore the error on thus field and continue to extract the next fields.

Can I consider this as a bug?

0 Karma

woodcock
Esteemed Legend

I could go either way on it myself but tend to agree with you. You have nothing to lose by filing a bug report with support.Splunk.com.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...