topic Re: Error when trying to extract fields in Splunk Search

Error when trying to extract fields

mcg_connor — Mon, 23 Dec 2019 20:53:03 GMT

I currently am trying to extract the externalDropshipId from the following log

 "updatedTimestamp" : "2019-12-23T20:43:04.774Z",
  "fulfillmentOrderId" : "124B27HTRBRZC9L6P9KL7GC968",
  "externalOrderId" : "9163225842155",
  "externalDropshipId" : "6372205554",

I am using the field extractor and selecting externalDropshipID as the required text and 6372205554 as the field.

This is resulting in the following error..
The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.

How would I go about fixing this?

Thanks

Re: Error when trying to extract fields

mydog8it — Mon, 23 Dec 2019 21:17:27 GMT

try replacing the regex in the field extractor with this:

externalDropshipId\W\s:\s"(?<externalDropshipId>\d+)"

Re: Error when trying to extract fields

mcg_connor — Mon, 23 Dec 2019 21:33:17 GMT

Thanks! Seems I should start learning regex's instead of relying on the Splunk extractor

Re: Error when trying to extract fields

mydog8it — Mon, 23 Dec 2019 21:41:16 GMT

regex101.com is a great site to test regex between that and the Splunk Quick Reference available here-->>
Splunk Quick Reference

You can get a start developing more complex field extractions than the field extractor was meant to provide.