https://community.splunk.com/t5/Splunk-Search/Field-extraction-on-post-multikv-field/m-p/11897#M862 <P>Well, to clarify, it will do almost just as you've set up above (though you're missing a field name for the extraction), it just can't be set up as an automatic extraction.</P> Wed, 21 Apr 2010 07:22:22 GMT gkanapathy 2010-04-21T07:22:22Z https://community.splunk.com/t5/Splunk-Search/Field-extraction-on-post-multikv-field/m-p/11895#M860 <P>Is it possible to create a field extraction on a field that only exists after piping through multikv?</P> <P>In other words, can I persist this: </P> <PRE><CODE>index="os" sourcetype="netstat" | multikv | rex field=LocalAddress "(?&lt;port&gt;\d{5})$" </CODE></PRE> Wed, 21 Apr 2010 04:20:10 GMT https://community.splunk.com/t5/Splunk-Search/Field-extraction-on-post-multikv-field/m-p/11895#M860 Simon_Shelston 2010-04-21T04:20:10Z https://community.splunk.com/t5/Splunk-Search/Field-extraction-on-post-multikv-field/m-p/11896#M861 <P>No, Splunk will not extract fields that are only present post multikv. This extraction will need to be based on the _raw field.</P> Wed, 21 Apr 2010 06:29:33 GMT https://community.splunk.com/t5/Splunk-Search/Field-extraction-on-post-multikv-field/m-p/11896#M861 Simon_Shelston 2010-04-21T06:29:33Z https://community.splunk.com/t5/Splunk-Search/Field-extraction-on-post-multikv-field/m-p/11897#M862 <P>Well, to clarify, it will do almost just as you've set up above (though you're missing a field name for the extraction), it just can't be set up as an automatic extraction.</P> Wed, 21 Apr 2010 07:22:22 GMT https://community.splunk.com/t5/Splunk-Search/Field-extraction-on-post-multikv-field/m-p/11897#M862 gkanapathy 2010-04-21T07:22:22Z https://community.splunk.com/t5/Splunk-Search/Field-extraction-on-post-multikv-field/m-p/11898#M863 <P>okay, i just edited it and saw the tag was htmlized away. so that should work as is. just can't make it auto whatever.</P> Wed, 21 Apr 2010 09:39:51 GMT https://community.splunk.com/t5/Splunk-Search/Field-extraction-on-post-multikv-field/m-p/11898#M863 gkanapathy 2010-04-21T09:39:51Z