topic Re: Field Extraction errors in Splunk Search

Field Extraction errors

jclehmuth — Fri, 07 Nov 2014 19:13:03 GMT

I keep receiving this error:
The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.

I am trying to create a field extraction for Src_ip. The IP I am trying to extract is at the end of the events, similar to below.

Nov 7 00:19:22 10.0.33.210 2014-11- 7 5:19:20 Retina: Retina has found Low Severity audit Scheduler Service Potential Security Hazard on ip 10.0.33.250.

Nov 7 00:19:19 10.0.33.210 2014-11- 7 5:19:17 Retina: Retina has found Medium Severity audit Account Lockout Reset Time on ip 10.0.33.250.

Nov 7 00:19:17 10.0.33.210 2014-11- 7 5:19:15 Retina: Retina has found Informational audit Microsoft Windows Share Allows Everyone Access on ip 10.0.33.250.

Re: Field Extraction errors

jclehmuth — Fri, 07 Nov 2014 19:14:01 GMT

I forgot to mention I'm using 6.2

Re: Field Extraction errors

martin_mueller — Fri, 07 Nov 2014 19:54:19 GMT

Assuming it's always prefixed by "on ip" and at the end of the line and sometimes followed by that period, you can use this regex:

on ip (?<src_ip>^\S+?)\.?$

Re: Field Extraction errors

jclehmuth — Fri, 07 Nov 2014 19:59:02 GMT

Thanks that worked, I had to minor adjust but it worked.

Re: Field Extraction errors

dehtallyutedeh — Tue, 03 Mar 2015 02:01:36 GMT

martin_muller,

Is there a guide on how to use the regex?
I have a similar problem.

My data
... Version/7.0 Mobile/11B554a Safari/9537.53", client-ip="55.555.555.55", x-akamai-config-log-detail="true", te="chunked;q=1.0", connection="TE", akamai-origin-hop="2"...

I'm trying to get the client-ip.

I tried client-ip=" (?^\S+?)\"?$ but it doesnt work. Any help?

Re: Field Extraction errors

s2_splunk — Tue, 03 Mar 2015 05:06:09 GMT

You have a self-describing log format using key=value pairs; Splunk should auto-extract all fields for you. Does it not?

Your RegEx should probably read

client-ip=\"(?<client-ip>.*)\"

to at least answer your question.

There are a bunch of RegEx learning/testing sources available on the interwebs. Google is your friend. 😉

Re: Field Extraction errors

dehtallyutedeh — Tue, 03 Mar 2015 18:52:37 GMT

No, Splunk didn't auto-extract it. Which I found very odd....

I'll look up some more RegEx information to get this solution to work.

Re: Field Extraction errors

mohan401 — Mon, 17 Jul 2017 10:28:46 GMT

I am also facing same issue in my case :
Nov 7 00:19:19 10.0.33.210 2014-11- 7 5:19:17 Retina: Retina has found Medium Severity audit from IP 10.0.33.250. Account Lockout Reset Time.

Nov 7 00:19:17 10.0.33.210 2014-11- 7 5:19:15 Retina: Retina has found Informational from IP 10.0.33.250. audit Microsoft Windows Share Allows Everyone Access

I am using regrx like :
from IP (?^\S+?).*
I am getting IP string.