topic Permanent Field extraction in Splunk Search

Permanent Field extraction

Karthikeya — Tue, 04 Feb 2025 16:15:44 GMT

Trying to get permanent field extraction for a field. Tried to use field extraction tabs in fields given regex there but getting failed. Giving the same in search working. I don't know why.

Below is the event:

host: juniper-uat.systems.fed

Connection: keep-alive sec-ch-ua-platform: ""Windows""

X-Requested-With: XMLHttpRequest

Need to extract the host value as 'fqdn' permanently.

given this regex - Host:\s(?<fqdn>(.+))\n in field extraction as attached below:

Karthikeya_0-1738685468488.png

But it is extracting whole event value starting from fqdn value. Not extracting correctly.

Please help me in this regard.

Re: Permanent Field extraction

gcusello — Tue, 04 Feb 2025 16:10:57 GMT

Hi @Karthikeya ,

I could be more detailed, if you can share the full event, anyway, you have to create a regex like the following:

| rex "host: (?<host>[^\s\n]+)"

Ciao.

Giuseppe

Re: Permanent Field extraction

luizlimapg — Tue, 04 Feb 2025 18:51:44 GMT

Hi @Karthikeya

It could be access permission to the extracted field. Go to the menu Settings > Fields, click on Field Extractions, and check if the permission for your field is correct. To ensure access for all users, set the app permissions to global and the Role permissions to Read for Everyone.