Problem Creating new search time field extraction Thru the REST API and Java Splunk SDK

misteryuku — Mon, 09 Apr 2012 00:32:23 GMT

I have a problem creating new search time field extractions using the Splunk's REST API and the Java SDK.

This is the java code.
RequestMessage reqMsg = new RequestMessage();
reqMsg.setMethod("post");
reqMsg.setContent("name=firstname&stanza=sexuality&type=EXTRACT&value=(?i)^[^,]*,\w+=(?P[^,]+)");

ResponseMessage resMsg = authService.send("/servicesNS/admin/search/data/props/extractions",reqMsg);

The result was an error :
HTTP 500 -- In handler 'props-extract': Data could not be written: /admin/search/props/sexuality/EXTRACT-firstname: (?i)^[^,]*,\w

How do i fix this so that i can create a new search time field extraction through the REST API using Java ?? and i also cannot create the extraction on the IFX the error still persists.

Re: Problem Creating new search time field extraction Thru the REST API and Java Splunk SDK

gkanapathy — Mon, 09 Apr 2012 06:53:24 GMT

please see my answer to your other similar question:

http://splunk-base.splunk.com/answers/44955/create-new-field-extraction-regex-expression-via-rest-api-java-sdk

topic Re: Problem Creating new search time field extraction Thru the REST API and Java Splunk SDK in Splunk Search

Problem Creating new search time field extraction Thru the REST API and Java Splunk SDK

Re: Problem Creating new search time field extraction Thru the REST API and Java Splunk SDK