Field extraction

syedabuthahir — Sat, 12 Sep 2020 14:09:00 GMT

Hi All,

I want to extract one particular filed under the description column but when i tried to extract the field i am getting the below error

"The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings."

i tried to extract through regex

Defined","category":"Not Defined","resolution_time":"Not Defined","response_sla_exclusion":"","sla_contract":"Met","long_description":"Contact Number: 9967795614Type: Error/FailureWebsite/URL: https://xxxxxxProduct Name: Automatic Ticket AssignmentWorkstation/Cubicle/Bay: xxxxxDescription: Kindly check Health Status alertCountry/Location: xxxxVersion Number: NA","problem_abstract":"Kindly check Health Status alert"}

in the above i want to extract only the Product name field

Can someone help me on this

Re: Field extraction

isoutamo — Sat, 12 Sep 2020 15:10:22 GMT

Can you post full (json?) event or raw, so we could see from where this extractions should do? Also your current spl query could help us to point you to right direction.
r. Ismo

Re: Field extraction

thambisetty — Sun, 13 Sep 2020 04:49:27 GMT

| rex "Product\sName\:\s+(?<ProductName>.*)Workstation"

topic Field extraction in Splunk Search

Field extraction

Re: Field extraction

Re: Field extraction