Splunk Search

Field extraction showing up for different sourcetype

xxkenta
Explorer

Hello. I used the Splunk field extractor to get a field from sourcetype=sourcetype_a
For some reason, when I search sourcetype=sourcetype_b, the field I extracted for sourcetype_a is showing up. The data in that field is nothing relevant as the logs are entirely different. Why is this happening, and how can I prevent it?

0 Karma
1 Solution

micahkemp
Champion

Is it maybe a simple key=value in the event? Those are extracted by default unless you disable it per sourcetype.

View solution in original post

micahkemp
Champion

Is it maybe a simple key=value in the event? Those are extracted by default unless you disable it per sourcetype.

xxkenta
Explorer

Checking back now, you would be correct.. it's interesting though because in the event it is actually key\=value which I didn't know Splunk would pick that out. Thank you!

0 Karma

micahkemp
Champion

Converted to an answer.

If you consider it the correct answer, please accept it so that the question no longer looks open.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...