topic Re: Save Button Grayed Out When Editing Regex (Field Extraction) in Splunk Search

Save Button Grayed Out When Editing Regex (Field Extraction)

jlemoine — Fri, 30 Dec 2016 18:34:57 GMT

I am trying to extract a new field from an event using regex in Splunk 6.5. I've progressed through the "Extract a New Field" walk through to a point where I have chosen to edit my own regex, however the "Save" button is grayed out, and I cannot progress.

My regex is fairly simple, and when I preview the results, it's 100% success against the sample events:

My simple regex = User: "\w+"

Can anyone tell me how to save my new field?

Re: Save Button Grayed Out When Editing Regex (Field Extraction)

arkadyz1 — Fri, 30 Dec 2016 20:00:32 GMT

I think you need at least one capturing group in your regex. Like this: User: "(?<user>\w+)" - this will extract a field named user from the quotes after "User: " prefix.

Re: Save Button Grayed Out When Editing Regex (Field Extraction)

niketn — Fri, 30 Dec 2016 20:10:57 GMT

Try some of the following:
1) Unchecking the "Original search included" option, see if it allows you to select.
2) If above does not work , Open the View in Search to check wither results are returned. Try increasing the date range.
3) If everything else fails you can manually create Field Extractions through Settings> Fields using the regex or Directly in the props.conf for your sourcetype.

Re: Save Button Grayed Out When Editing Regex (Field Extraction)

jlemoine — Wed, 04 Jan 2017 22:45:36 GMT

Awesome! This worked like a charm.