Back to Floor
The Parsing Engine • Room 3
🖥️ SPL Lab: Investigating Parse Issues
When events are not being parsed correctly, the _internal index holds the clues. Parsing warnings about line-breaking, timestamp extraction failures, and truncated events all show up there.
Common issues include events being merged together (SHOULD_LINEMERGE too aggressive) or timestamps not being extracted (wrong TIME_FORMAT in props.conf).
Use "| metadata type=sourcetypes index=<your_index>" to quickly see all sourcetypes and their event counts.
Knowledge Check
Prove your understanding to clear the room (Rewards XP)
Write a search that lists all sourcetypes in the main index with their total event count, sorted by count.
Splunk Search Bar
>