topic Re: Extracted field not shown in the search in Splunk Search

Why us extracted field not shown in the search?

corti77 — Wed, 22 Jun 2022 19:44:51 GMT

Hi,

I went to the search of my own app I created a extracted field using the wizard. Once created, I go to Settings--> Fields extractions I can see the extracted field , type inline, assigned to my app , enabled and with permissions on the App for everyone read and write.

then I go to my app once again and I perform a simple query in verbose mode. To be sure I also click on All fields to be sure that all fields are actually shown

index=cisco sourcetype="cisco:esa:amp"

Unfortunately the extracted field does not show on the list.

any idea what I am missing?

many thanks

Re: Extracted field not shown in the search

isoutamo — Wed, 22 Jun 2022 12:14:24 GMT

Have you tested this e.g. with https://regex101.com ?

You events have this sourcetype and you probably are in this app (based on screenshot yes)?

r. Ismo

Re: Extracted field not shown in the search

gcusello — Wed, 22 Jun 2022 12:22:41 GMT

Hi @corti77,

did you tried to extract that field using rex inside the search?

what does it happen if you run?

index=cisco sourcetype="cisco:esa:amp" your_field=*

Ciao.

Giuseppe

Re: Extracted field not shown in the search

corti77 — Wed, 22 Jun 2022 13:32:15 GMT

yes, I did that to workaround the issue.

this works perfectly

index=cisco sourcetype="cisco:esa:amp" | rex field=_raw "Malware = (?<malware>.+?),"

Re: Extracted field not shown in the search

gcusello — Wed, 22 Jun 2022 13:37:52 GMT

Hi @corti77,

if the field extraction runs with the rex command, you should see it also without rex.

what's the sourcetype associated to the field extraction that you can see? it should be "cisco:esa:amp".

Ciao.

Giuseppe

Re: Extracted field not shown in the search

corti77 — Wed, 22 Jun 2022 14:46:48 GMT

it is cisco:esa:amp