topic Re: New field created through field transformation not appearing in search results in Splunk Search

New field created through field transformation not appearing in search results

pkbhavani — Thu, 12 Sep 2019 20:16:27 GMT

I have created a field called PROCESS via Fields » Field transformations

I could not see in the field appear in the search results.

Also, I could not set up a field using Field extractions as it only works on data _raw field.

jpolvino — Fri, 13 Sep 2019 17:28:55 GMT

Try this for your regular expression:

\/flcc-logs\/(?<PROCESS>[^\/]+)

You can also do this "live" as part of your search:

(your search)
| rex "\/flcc-logs\/(?<PROCESS>[^\/]+)"