topic Re: Why does Field extraction requires trim? in Splunk Search

Why does Field extraction requires trim?

JarrettM — Tue, 30 Jan 2018 16:45:01 GMT

My iis data has a field name cs_uri_query, for example:

Cmd=Sync&User=XYZ%5Cjqpublic%40xyz.com&DeviceId=SEC539D6F312D5B3&DeviceType=SMG930V

Thusernameme is embedded in this field and I use the following regex to extract a new field called user_name:

^[^%]*%\d\w(?P\w+)

The new field is extracted properly and shows as:

user_name  = jqpublic

However, if I do a specific search like:

index=iis host=server1 user_name=jqpublic

I get no results.

Only if I trim the field, or use a wildcard, are results returned:

index=iis | eval user_name=trim(user_name) | search user_name=jqpublic

Any thoughts why trim is required here?

Thanks!

Re: Why does Field extraction requires trim?

493669 — Tue, 30 Jan 2018 16:58:31 GMT

Hey have you tried this:

index=iis|rex "^[^%]*%\d\w(?P<user_name>\w+)"|search user_name="jqpublic"

Re: Why does Field extraction requires trim?

JarrettM — Tue, 30 Jan 2018 17:11:46 GMT

Yes that works, as does creating a calculated field that trims the extracted field. But what I want to know is why any of this is necessary. Why doesn't the original extraction work correctly?

Thanks!

Re: Why does Field extraction requires trim?

493669 — Tue, 30 Jan 2018 17:17:29 GMT

not sure which regex expression you are using...
It seems your extracted user_name field contains spaces so you need to trim...