Getting Data In

All fields not displayed in the result but the event is picked up

ketki
New Member

The following works fine in the search bar.
index=i_a sourcetype=a_out| transaction source maxspan=1h|rex field=source "[\w\W]+/(?[A-Z0-9_]).(?\d)_(?\d*).out" | eval Time=strftime(_time, "%m/%d/%Y %H:%M:%S") | table Job_Name PID Time

Props.conf entry is as follows
[a_out]
TZ = America/New York
TIME_FORMAT = %m/%d/%Y %H:%M:%S
SHOULD_LINEMERGE = False
KV_MODE=none
EXTRACT-sourcefields =[\w\W]+/(?[A-Z0-9_]).(?\d)_(?\d*).out in source
EXTRACT-jobid = JobId=(?\d*)
EXTRACT-batch_type = Batch_Type=(?\w*)

file is of the format - RUN_D_INCR_ABC_INCR_9_TESTF_EXP_C.20130801023732_99999.out.
(JOBNAME.DATE_PROCESSID.OUT)

Problem - The report only displays the Time and doesn’t display jobname/PID.

“View results” from the report is
index=i_a sourcetype=a_out | transaction source maxspan=1h | eval Time=strftime(_time, "%m/%d/%Y %H:%M:%S") | table Job_Name PID Time

0 Karma

lukejadamec
Super Champion

I have seen this before when some of the fields have no value. Try fillnull. Here is a link to fillnull:
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

0 Karma

lukejadamec
Super Champion

Also, you should use comma separated fields:
Job_Name,PID,Time

0 Karma

linu1988
Champion

Could you get sample logs for us? Are the fields shown when used without transaction?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...