topic Re: Field extract NOT search. in Splunk Search

Field extract NOT search.

khyoung7410 — Tue, 29 Sep 2020 22:50:53 GMT

Hi
My data format is as follows.
A=123456789
Field was extracted for every three digits from field A.
My field extract

A=(?P[0-9]{3})(?P[0-9]{3})(?P[0-9]{3})
New field name is A_1, A_2, A_3

The field is extracted but not searched by A_1=123.
My search Ex
index=main sourcetype=test A_1="123"
search not running.....

renjith_nair — Tue, 29 Sep 2020 22:52:59 GMT

Try named groups

|makeresults|eval A=123456789
|rex field=A "(?<A_1>[0-9]{3})(?<A_2>[0-9]{3})(?<A_3>[0-9]{3})"

This should result three fields A_1,A_2,A_3 and you can search where A_1=123

khyoung7410 — Mon, 21 Jan 2019 04:21:21 GMT

Hi renjith.nair

But Not searched after registering for field extraction.