All Apps and Add-ons

Searching PCF data using subscription-id field doesn't produce results

johnansett
Communicator

Hey guys, got a kinda weird one. I am have PCF (Pivotal Cloud Foundry) data coming into an index from 3 clusters.

I can see the three cluster's in the subscription-id field when I search the whole index:
index=pcf
However if I try and isolate on a cluster using subscription-id it doesn't work.

index=pcf subscription-id=*

Works

index=pcf subscription-id="cluster-a-1"

Does NOT

index=pcf subscription-id="cluste*"

Works

index=pcf subscription-id="cluster-a*"

Does NOT

It also means the PCF apps don't work.

Any ideas what might be going on here. Not sure if this is specific to the PCF data or other data sources as well but this is the only one I've seen so far.

Thanks!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@johnansett,

One silly solution as I've doubt about field name. index=pcf | rename "subscription-id" as subid | search subid=*. Try and let me know your feedback.

0 Karma

guilmxm
SplunkTrust
SplunkTrust

HI @johnansett

I know this post is a bit old, but did you find how to get the subscription-id field ?
Got a customer starting to ingest PCF data, I re-factored the app to fix several issues it has, some searches will work but most don't because of this field not existing.

Guilhem

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...