Splunk Search

Splunk Search Log SearchOperator:kv

pkeller
Contributor

When I use the Job Inspector to view the Search Log of a completed search, I find hundreds of entries tagged: SearchOperator:kv that seem to have absolutely nothing to do with the sourcetype or datasource of the search ...

ie: I'll see hundreds of regexes that are from EXTRACT-blah-blah ... that are explicitly for other sourcetypes. I'm concerned that I have a configuration issue. Lately we've had some complaints about search performance and I'm currently wondering why all this unrelated noise in the search log? Is Splunk actually trying to perform search time extractions for data that doesn't match the sourcetype the extraction was intended for?

Tags (1)

jtrujillo
Path Finder

I dont feel that this question has been answered yet. @MuS suggestions may work, but doesnt help in a large environment when things need to be global.

The big question here is why is splunk trying to do sourcetype extracts on a source that has nothing to do with the sourcetype being searched?

MuS
SplunkTrust
SplunkTrust

This is hard to answer without any detailed knowledge of your setup. But I would start by checking for global permission of Apps and change it back to be App, next would be to check any rouge * entries in props.conf, last but not least run your searches in Fast Mode and add any needed field in the base search.

Hope this helps, even it might not be the solution

cheers, MuS

0 Karma

clanier
Explorer

Hey MuS. Seems as if what I am referring to are Calculated-Fields. I have asked this [question][1], I when I do searches on a sourcetype for example syslog, search.log reflects calculated-fields from other sourcetypes. I am looking about how to deactivate these calculated-fields in searching not pertaining to them. Thanks, Cam.

https://answers.splunk.com/answers/586903/calculated-fields-automatically-included-in-search.html?mi...

0 Karma

clanier
Explorer

Thanks MuS I appreciate the answer, I will investigate these areas shortly.

0 Karma

clanier
Explorer

I too have this question, was hoping if any resolutions have been found. I am running into the same issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...