All Apps and Add-ons

Searching PCF data using subscription-id field doesn't produce results

johnansett
Communicator

Hey guys, got a kinda weird one. I am have PCF (Pivotal Cloud Foundry) data coming into an index from 3 clusters.

I can see the three cluster's in the subscription-id field when I search the whole index:
index=pcf
However if I try and isolate on a cluster using subscription-id it doesn't work.

index=pcf subscription-id=*

Works

index=pcf subscription-id="cluster-a-1"

Does NOT

index=pcf subscription-id="cluste*"

Works

index=pcf subscription-id="cluster-a*"

Does NOT

It also means the PCF apps don't work.

Any ideas what might be going on here. Not sure if this is specific to the PCF data or other data sources as well but this is the only one I've seen so far.

Thanks!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@johnansett,

One silly solution as I've doubt about field name. index=pcf | rename "subscription-id" as subid | search subid=*. Try and let me know your feedback.

0 Karma

guilmxm
SplunkTrust
SplunkTrust

HI @johnansett

I know this post is a bit old, but did you find how to get the subscription-id field ?
Got a customer starting to ingest PCF data, I re-factored the app to fix several issues it has, some searches will work but most don't because of this field not existing.

Guilhem

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...