topic Re: Why is my extracted field not showing up in search result in Splunk Search

Why is my extracted field not showing up in search result

arpitpropay — Wed, 30 Sep 2020 00:22:55 GMT

I have several log files as source of Splunk events.

C:\logs\Srv1\file1_2019-05-06.log
C:\logs\Srv84\file3_2019-05-06.log
C:\logs\Glob9\file18_2019-05-06.log

I am trying to extract the immediate parent directory name from the source field of events. So in a custom extracted field "appname", I am hoping to get values Srv1, Srv84 and Glob9 from examples above.

Here's what I am doing.

Splunk Web > Settings > Fields > Fields Extractions > Add new

Destination app: search
Name: source_app_name
Apply to: source named: app_name
Type: Inline
Extraction/Transform: ^.+\x5C(?<appname>(.+))\x5C[^\x5C]*$

Sharing: Global, All apps, Read permission to everyone.

When I run my search ...| extract reload=t I can't find appname field in All fields. All fields is selected in the Select field list.

Am I doing anything wrong with my field extraction, or with my search?

Re: Why is my extracted field not showing up in search result

vishaltaneja070 — Wed, 08 May 2019 07:48:45 GMT

Hello @arpitporpay

The best way to do this is:
Go to Splunk Web > Settings > Fields > Fields Extractions > Add new

then add the below attributes:

app_name: <your app name>
name: source_app_name
sourcetype : < as per your requirement>  --- the above mentioned source is incorrect as it is asking for which source it need to apply so it is better to use sourcetype.
Type: uses trasform
extraction: appname

Go to Splunk Web > Settings > Fields > Field transformations > Add new

destination_app: <your app name>
name : appname
type: regex-based
regular expression: ^.+\x5C(?<appname>(.+))\x5C[^\x5C]*$
source_key : source

Thanks!

Re: Why is my extracted field not showing up in search result

vishaltaneja070 — Wed, 08 May 2019 07:51:19 GMT

Otherwise:

props.conf

[your_sourcetype]
REPORT-appname1= appname

transforms.conf
[appname]
REGEX= ^.+\x5C(?(.+))\x5C[^\x5C]*$
SOURCE_KEY = source

Re: Why is my extracted field not showing up in search result

vishaltaneja070 — Wed, 08 May 2019 12:29:12 GMT

@arpitpropay : Could you please accept the answer to close the conversation.

Re: Why is my extracted field not showing up in search result

arpitpropay — Wed, 08 May 2019 15:30:54 GMT

Thanks @vishaltaneja07011993 your solution (using field transformation in field extraction) worked for me.