why field extraction doesn't work when defined as calculated field?

danielbb — Thu, 07 Aug 2025 15:42:09 GMT

I have this regex -
^(?:[^ \\n]* ){7}(?P<src_host>[^ ]+)[^:\\n]*:\\s+(?P<event_id>[a-f0-9]+:\\d+)(?:[^/\\n]*/){2}(?P<dest_zone>[^\\.]+)

I put it in the field extraction with the right sourcetype as inline field extraction, and it still won't show the extracted fields when searched.

_internal shows that its status is - "applied"

Any idea why?

Re: why field extraction doesn't work when defined as calculated field?

livehybrid — Thu, 07 Aug 2025 15:47:33 GMT

Hi @danielbb

Try removing the "P" from each extraction - Splunk uses PCRE (Perl Compatible Regular Expressions) Regex not RE2 so does not include the P in the named extraction.

I also noticed that you mentioned "calculated" field extraction - this expects something can be eval'd not a regex. What you need to use is a "Field Extractions" if editing in the UI, and then add the regex in the "Extraction/Transform" field.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

topic Re: why field extraction doesn't work when defined as calculated field? in Splunk Search

why field extraction doesn't work when defined as calculated field?

Re: why field extraction doesn't work when defined as calculated field?