topic Re: Field Extractraction problem ?? in Knowledge Management

Field Extractraction problem ??

rakesh_498115 — Wed, 12 Dec 2012 15:20:51 GMT

Hi .

I have written the following regex in my query , then it is working fine but when i am trying to create this regex expression in the field extractor it is not coming in the query.

My regex expression ::

(?(?im)"(Request|Response)")

Query Used after creating field extractor ::

Sourcetype="mydata" | top Test

but this is not workin ..Please help ..

Re: Field Extractraction problem ??

lguinn2 — Thu, 13 Dec 2012 03:25:10 GMT

First, the names of fields are case-sensitive. You created a field named "test" but then your top command used a field called "Test". That's never going to work.

Second, although your regular expression may be legal, I would have written it:

(?im)(?<test>"(?:Request|Response)")

I have noticed that Splunk is sometimes finicky about non-capturing parenthesis; this regular expression is a bit clearer. And are the quotation marks actually in the data? Do you really need them for the regular expression?

Re: Field Extractraction problem ??

rakesh_498115 — Thu, 13 Dec 2012 18:44:43 GMT

No quotation marks are not need lginn .. thnx for the regular expression .this worked for me..:)