Splunk Search

Cannot search customized field ...

sunrise
Contributor

I can search by the following field key,

test_field=*

and Splunk Web displayed the lists.
Then I select the "test_field=testA"(so following keywords), but displayed no lists.

test_field=* test_field=testA

And the following search command display no result.

test_field=testA

Furthermore, I add "| search" between the two kewords, then displayed properly.

test_field=* | search test_field=testA

Why is this happened ?
Thank you for helping.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You're not telling us how your field is extracted, but I strongly suspect that what you're see is what is described here: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Basically you're likely extracting a field value that isn't part of indexed data, or only part of a token in indexed data. For instance, in the first case, the field could have been extracted in something like this manner:

[myfieldextraction]
REGEX = (matchsomething)
FORMAT = myfield::someothertext

...so the field would have the value "someothertext" even though that value doesn't actually exist at all in the index.

Or, in the second case, the extraction would look something like this:

[myotherfieldextraction]
REGEX = (matchjust)apartofaword
FORMAT = myotherfield::$1

If any of these apply to your extraction, you are very likely seeing the effects that the blog post I linked to talks about.

View solution in original post

0 Karma

Ayn
Legend

You're not telling us how your field is extracted, but I strongly suspect that what you're see is what is described here: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Basically you're likely extracting a field value that isn't part of indexed data, or only part of a token in indexed data. For instance, in the first case, the field could have been extracted in something like this manner:

[myfieldextraction]
REGEX = (matchsomething)
FORMAT = myfield::someothertext

...so the field would have the value "someothertext" even though that value doesn't actually exist at all in the index.

Or, in the second case, the extraction would look something like this:

[myotherfieldextraction]
REGEX = (matchjust)apartofaword
FORMAT = myotherfield::$1

If any of these apply to your extraction, you are very likely seeing the effects that the blog post I linked to talks about.

0 Karma

sunrise
Contributor

Thank you, Ayn.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...