topic Re: Why Field Extraction Stopped Working in Splunk Search

Why Field Extraction Stopped Working

RowdyRodney — Wed, 02 Jul 2025 15:06:50 GMT

Hello - I created a Field Extraction to look for a file extension. The raw log looks like this:

"FileName": "John Test File.docx"

The regex I used was:

"FileName":\s".+\.(?P<Domain>.[a-zA-Z0-9]*)

This tests out in any regex tester I use. When I first created this, I ran a search query and some of the fields populated, but some were blank. I then checked which records weren't being extracted correctly, and found the regex matched the raw log pattern, so I was unsure why it wouldn't have extracted.

However, ~30 minutes after creating this field extraction. It stopped extracting anything. The state I'm now, I can see that each raw log record matches my extraction regex, but the fields are still empty and this isn't being extracted. Why would that be?

Each raw log matches the regex in the extraction...

Re: Why Field Extraction Stopped Working

livehybrid — Wed, 02 Jul 2025 15:17:24 GMT

Hi @RowdyRodney

How are you doing this extraction? Is it a search-time extraction in Splunk Enterprise/Cloud?

These use PCRE based Regex whereas you have provided a Python-style named capturing group (?P...)

Please can you update this to a PCRE based regex and see if this resolves the issue?

"FileName":\s".+\.(?<Domain>.[a-zA-Z0-9]*)

Can I also check, is the intention that it matches the file extension (docx) in your sample data?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Why Field Extraction Stopped Working

RowdyRodney — Wed, 02 Jul 2025 15:23:38 GMT

Thank you that helped!