Getting Data In

Why can't I see any results while searching a search-time extracted field value?

mchang_splunk
Splunk Employee
Splunk Employee

I have a search-time extracted field defined in props.conf:

[foo]
EXTRACT-fields = msg=\".{20}(?<newfield>.{6})    

The sample log:

Wed Feb 27 17:12:03 EST 2019 msg="020202P032929055801 FINDME

I can see "FINDME" as a value of newfield listed in "field explorer" on UI while searching "sourcetype=foo"

When I search "sourcetype=foo newfield=FINDME", no result is found.

However, I can get results while searching:

sourcetype=foo newfield=*FINDME

How can I fix this issue?

0 Karma
1 Solution

mchang_splunk
Splunk Employee
Splunk Employee

This issue should be able to resolved by adding fields.conf on all the indexers:
fields.conf

[newfield] 
INDEXED_VALUE = *<VALUE>

It's not working if you put fields.conf on search head.

View solution in original post

0 Karma

mchang_splunk
Splunk Employee
Splunk Employee

This issue should be able to resolved by adding fields.conf on all the indexers:
fields.conf

[newfield] 
INDEXED_VALUE = *<VALUE>

It's not working if you put fields.conf on search head.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...