Getting Data In

Why can't I see any results while searching a search-time extracted field value?

mchang_splunk
Splunk Employee
Splunk Employee

I have a search-time extracted field defined in props.conf:

[foo]
EXTRACT-fields = msg=\".{20}(?<newfield>.{6})    

The sample log:

Wed Feb 27 17:12:03 EST 2019 msg="020202P032929055801 FINDME

I can see "FINDME" as a value of newfield listed in "field explorer" on UI while searching "sourcetype=foo"

When I search "sourcetype=foo newfield=FINDME", no result is found.

However, I can get results while searching:

sourcetype=foo newfield=*FINDME

How can I fix this issue?

0 Karma
1 Solution

mchang_splunk
Splunk Employee
Splunk Employee

This issue should be able to resolved by adding fields.conf on all the indexers:
fields.conf

[newfield] 
INDEXED_VALUE = *<VALUE>

It's not working if you put fields.conf on search head.

View solution in original post

0 Karma

mchang_splunk
Splunk Employee
Splunk Employee

This issue should be able to resolved by adding fields.conf on all the indexers:
fields.conf

[newfield] 
INDEXED_VALUE = *<VALUE>

It's not working if you put fields.conf on search head.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...