topic Field Extraction in Splunk Search

Field Extraction

Abha — Wed, 15 May 2013 16:13:51 GMT

Hi
I extracted a couple of fields from my input data.
However, those fields are not showing on the Fields Sidebar. Though I can view them in the Manager>>Fields>>Field Extractions.
What do I do now?

Re: Field Extraction

rgcurry — Wed, 15 May 2013 18:19:42 GMT

I typically create my field extractions by editing the props.conf directly, but I'm a shell bigot. (8->) When ever I cannot see my fields defined in the Fields Sidebar, I realize that I have failed to create metadata for my fields. As you are using the Web UI, I am not certain what might be doing this for you. Do you have access to the file system? Check the metadata/local.meta file in your app's etc/apps directory and assert that it has permissions set for your fields.

Re: Field Extraction

Drainy — Wed, 15 May 2013 19:23:41 GMT

How did you create the field extracts and have you tested that they work anywhere?

Re: Field Extraction

Abha — Thu, 16 May 2013 10:46:46 GMT

Well I simply created them using the web UI. Since I can only view them in Fields>> Field Extractions..dunno how I could test them..Any ideas?

Re: Field Extraction

Abha — Thu, 16 May 2013 10:48:00 GMT

Checked the local.meta file. Things seem to be in order there...

Re: Field Extraction

wpreston — Thu, 16 May 2013 12:08:12 GMT

I'd recommend testing your field extractions using the rex command in a search before adding them to the extractions page. Just enter your search terms, followed by | rex "your regular expression field extraction". I usually also follow it with | stats values myFieldName just to make sure I pick up only the values I wanted and don't have to adjust my regex. So for instance, if I were extracting browser from a log, I might use the following search to test my field extraction:

your search terms | rex "userAgent=(?<browser>[^(]+)" | stats values browser