topic Re: extracting the field in Splunk Search

extracting the field

splunkpoornima — Wed, 07 Nov 2012 11:28:11 GMT

hi all

please help me in extracting the feild called Failed from the following events

Mon Jun 25 11:13:41 CDT 2012,UpdateDealStartPricesTask,Status : Completed with errors

Total chunks = 5

Successful chunks = 3

Failed chunks = 2

i used the extract fields -->i typed the failed there and i generate but its shows me

No regex could be learned. Try providing different examples or restriction.

Re: extracting the field

smolcj — Wed, 07 Nov 2012 11:44:33 GMT

you should narrow your search , so that you will get the source file with your field to be extracted. the examples you are providing should be there in the right side.

Re: extracting the field

dmaislin_splunk — Wed, 07 Nov 2012 13:08:17 GMT

Just create or modify the field extraction to be:

^Failed chunks\s=\s(?\d+)

Re: extracting the field

Rob — Wed, 07 Nov 2012 19:43:20 GMT

Just to expand what @dmaislin_splunk is saying. You can use the rex command with the regex above like this:

|rex field=_raw "^Failed\schunks\s=\s(?<failedchunks>\d+)"