topic Re: Why am I unable to filter log data from extract fields? in Splunk Search

Why am I unable to filter log data from extracted fields?

Manideep — Fri, 16 Sep 2022 14:14:21 GMT

scenario : - I had a log file. I am able to extract the fields from the log event and also see the data in the extracted fields. But when I am filtering the data with use of extracted field, unable to see the results although it has data in the extracted field.

I have referred to this "http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/" link it doesn't help.

Please help us regarding this.

Re: Why am I unable to filter log data from extract fields?

gcusello — Thu, 15 Sep 2022 15:26:41 GMT

Hi @Manideep,

could you share your not working search?

ciao.

Giuseppe

Re: Why am I unable to filter log data from extract fields?

Manideep — Thu, 15 Sep 2022 15:33:09 GMT

My query | rex field=_raw "(?msi)(?<SiteId>(?<=SiteId:).+?(?<=\n))" | spath input=SiteId

with the above query i am able to see the values under "SiteId" fields

Re: Why am I unable to filter log data from extract fields?

gcusello — Fri, 16 Sep 2022 05:42:12 GMT

Hi @Manideep,

I assume that the regex correctly extracts values.

the field name is exactly "SiteId" or there's something before?

are you shure about the case of the letters in the field name? values aren't case sensitive but field names are case sensitive.

Then, having you a regex, why do you use spath?

Ciao.

Giuseppe