topic Re: Field Extraction and Search Not Syncing Properly in Splunk Search

Field Extraction and Search Not Syncing Properly

mhomolka — Fri, 31 May 2013 17:01:18 GMT

I am having a problem where I can extract a field, but when using that field in the search it will not return results. I believe I have narrowed the problem down to being an issue with me removing part of the word that is unneeded (it is the same on each field).

Here is an example:

^.*Test(?<extracted>[^:]).*$

TestOne returns 'One', TestTwo returns 'Two', etc.

But when I search using extracted it will fail unless I do one of the following (which both I would prefer to avoid):

Change the regex:

^.*(?<extracted>Test[^:]).*$

TestOne returns 'TestOne', TestTwo returns 'TestTwo', etc.

Add a wildcard at the front of the search: extracted="*One" to get all 'TestOne'

Re: Field Extraction and Search Not Syncing Properly

Ayn — Sat, 01 Jun 2013 18:20:18 GMT

You're probably seeing the effects of what is described here: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Basically Splunk breaks down event data into individual segments and uses those for searching. When you define extractions that do not correspond to any segment Splunk won't find anything.

Re: Field Extraction and Search Not Syncing Properly

mhomolka — Mon, 03 Jun 2013 16:05:03 GMT

I don't believe this is the answer. In the document it says that I should be able to search using Myfield="*" | search="Valid" and it would work. However, this doesn't work for mine either.

Edit: Just wanted to clarify, this isn't necessarily wrong. I just think there is more to the answer as the test still fails for me.

Re: Field Extraction and Search Not Syncing Properly

mhomolka — Mon, 03 Jun 2013 17:03:26 GMT

I was incorrect. I had changed the regex temporarily so that the reports would work correctly and forgot to change them back for the test. Thanks!