Splunk Search

Why do I no longer see certain fields being parsed in Splunk search results?

NimrodSky
Explorer

Hi

For some reason, Splunk is not parsing data anymore - whenever I load new files or forward syslog, while I see the raw event in the search, I only get some generic fields such as - sourcetype, splunk_server, index, linecount, and _time.

Nothing was changed as far as I know - no new version, no changed configurations.

Thanks

0 Karma
1 Solution

jplumsdaine22
Influencer

Are you by any chance searching in Fast Mode? If so you will see no field extractions. Change back to Smart Mode.

If you have the same problem then make sure your field extractions are correctly loads. Run

$SPLUNK_HOME/bin/splunk/cmd btool props list --debug

This will show you all the field extractions present and which file they are loaded from.l If you don't see yours then check where your props and transforms entries are.

View solution in original post

jplumsdaine22
Influencer

Are you by any chance searching in Fast Mode? If so you will see no field extractions. Change back to Smart Mode.

If you have the same problem then make sure your field extractions are correctly loads. Run

$SPLUNK_HOME/bin/splunk/cmd btool props list --debug

This will show you all the field extractions present and which file they are loaded from.l If you don't see yours then check where your props and transforms entries are.

NimrodSky
Explorer

That was the issues -thanks!

0 Karma

jplumsdaine22
Influencer

🙂 Fast mode gets me at least once a week

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...