topic Re: Having trouble with field extractor on 7.0 in Splunk Search

Having trouble with field extractor on 7.0

greggz — Tue, 12 Dec 2017 09:56:04 GMT

I have ton a couple of events like this:

Mime.stuff.1 = 10
Mime.pop = "blabla"

Basically I want to create a field "MimeProperty" and the require is to begin with a "Mime.". I'm having trouble working with the extractor as I don't fully understand it. Can anyone point me in the right direction ? Thanks in advance

Re: Having trouble with field extractor on 7.0

mayurr98 — Tue, 12 Dec 2017 10:09:10 GMT

can you please elaborate on more sample events?
also what do you want to extract? 10 and blabla?

Re: Having trouble with field extractor on 7.0

greggz — Tue, 12 Dec 2017 10:41:24 GMT

Those would be the values yes. I wan't every field that's starts off with Mime

Re: Having trouble with field extractor on 7.0

mayurr98 — Tue, 12 Dec 2017 10:58:17 GMT

Try this :

index=your_index | rex field=_raw "Mime.*\=\s(|\")(?P<MimeProperty>[^\s|\"]+)"

Let me know if it helps!!

If you get improper output then pls provide some sample events. like there is a confusion of space after "="
in every event.

Re: Having trouble with field extractor on 7.0

greggz — Tue, 12 Dec 2017 11:49:49 GMT

@mayurr98 Nice it works plenty! Post as an answer for me to mark it as correct

Re: Having trouble with field extractor on 7.0

mayurr98 — Tue, 12 Dec 2017 12:03:35 GMT

You are welcome,
i have converted Please accept!