topic Re: How to include Field Extraction name in Splunk search? in Splunk Search

How to include Field Extraction name in Splunk search?

friscos — Thu, 22 Sep 2016 14:17:22 GMT

Hi,

I have extracted a transaction id using field extraction.

Field Extraction Name: BANK_APPLOG : EXTRACT-TransID
RegEx: ^(?:[^>\n]*>){4}(?P<TransID>\w+)

How do i include this field extraction name in the search so that I can retrieve all the transaction ids.

gcusello — Thu, 22 Sep 2016 14:22:54 GMT

If you completed the field extraction and saved it you can use the field in your searches.
Otherwise you could use it adding a command

rex "^(?:[^>\n]*>){4}(?P<TransID>\w+)"

and use it.
Bye.
Giuseppe

inventsekar — Thu, 22 Sep 2016 14:22:56 GMT

Index=ABC (sourcetype=ghi, source=def if needed) TransID |table TransID, _raw

friscos — Thu, 22 Sep 2016 14:58:47 GMT

I have tried this but this retrieves all the events and not by transaction id.

index=main sourcetype=BANK_APPLOG |  rex "^(?:[^>\n]*>){4}(?P<TransID>\w+)"

friscos — Thu, 22 Sep 2016 15:00:12 GMT

I tried index=main sourcetype=BANK_APPLOG TransID | table TransID, _raw but this did not return any results.