Hello Splunk Ninjas...
I came across some peculiar behaviors recently and cannot get my head around it...My best guess is to fully leverage the power of all your combined brains into shedding some light...eventually?
Here's the deal:
I get an incremental feed from an Oracle db via dbx2 and it seems to be working flawlessly. _raw is subsequently made of all combined db rows and column which displays onscreen as comma separated value events. For each event, there is an AUTHOR which I've validated from the db.
[base search] | table _raw, AUTHOR
But, somewhat, the AUTHOR field failed to be extracted, even though is belongs to _raw as illustrated below:
Any clues ladies and gents?
Many thanks for your help.
... View more