topic Re: Extracted fields not showing up in Interactive search in Splunk Search

Extracted fields not showing up in Interactive search

sourabhguha — Sat, 23 Mar 2013 15:30:17 GMT

I have the following regex for an extracted field

(?i)^(?:[^,]*,){1}(?P<OM-InstanceName>[^,]+)  
(?i)^(?:[^,]*,){2}(?P<OM-ObjectName>[^,]+)  
(?i)^(?:[^,]*,){3}(?P<OM-PerfCounterDataID>[^,]+)

When I test the regex it does return the expected fields.

However, the fields do not show up in the search app (on the left side menu - next to the events list)

I have other sourcetypes with extracted fields and they work fine. The only difference for this sourcetype is that I chose the option to 'index only once' when I added the data to Splunk.

Any clues on why the extracted fields are not showing up.

Re: Extracted fields not showing up in Interactive search

kristian_kolb — Sat, 23 Mar 2013 16:31:43 GMT

Not too sure what you mean with the "index only once", but then I haven't really used the wizard-style way of adding data to Splunk. One thing that does look like it could be the source of your problems is that your field names contain hyphens, which at least in the past has been a problem.

Assuming that your regexes work fine in other tools, I'd suggest that you use underscore instead and call your fields;

OM_ObjectName
OM_PerfCounterDataID

etc etc

Hope this helps,

Kristian

Re: Extracted fields not showing up in Interactive search

sourabhguha — Sat, 23 Mar 2013 18:03:57 GMT

thanks! that resolved the issue. I renamed it to OMObjectname (removed the '-', did not use underscore).