topic Re: Field Extraction is not working in Splunk. in Splunk Search

Field Extraction is not working in Splunk.

skukreja — Thu, 02 Mar 2017 11:59:17 GMT

I am working on MS Azure logs and some of the fields are not getting parsed so I tried to use the field extraction in splunk however I am not getting those field parsed after doing all the steps involved in field extraction.

I have tried both regex and delimiter based field extraction.

Appreciate any kind of help on this issue.

Re: Field Extraction is not working in Splunk.

richgalloway — Thu, 02 Mar 2017 12:39:54 GMT

Kindly post a sample of the log entries you wish to parse.

Re: Field Extraction is not working in Splunk.

skukreja — Thu, 02 Mar 2017 13:12:03 GMT

Hi Rich,

1.0;20170302T12:56:26.2817264Z;QueryTables;Success;200;6;6;authenticated;StorageAccountName;table;"https://StorageAccountName.table.core.windows.net:443/Tables";"/";xxxxx;0;**IP Address**:62615;2015-07-08;532;0;250;12;0;;;;;;"Azure-Storage/0.32.0 (Python CPython 2.7.11; Windows 2012ServerR2)";;"xxxxxx

I want to parse StorageAccountName & IP Address in the log.

Re: Field Extraction is not working in Splunk.

richgalloway — Thu, 02 Mar 2017 13:35:44 GMT

This regex string should extract the two fields you mentioned.

(?:[^;]+;){8}(?<storAcctName>[^;]+);(?:[^;]+;){5}(?<ipAddress>[^;]+);

If you want the IP address without port number, use this.

(?:[^;]+;){8}(?<storAcctName>[^;]+);(?:[^;]+;){5}(?<ipAddress>[^:]+):

Re: Field Extraction is not working in Splunk.

skukreja — Thu, 02 Mar 2017 14:02:01 GMT

Hi Rich,

All the fields are getting parsed in the extract field wizard but still not getting them in search.

Sumit Kukreja

Re: Field Extraction is not working in Splunk.

skukreja — Thu, 02 Mar 2017 14:06:22 GMT

Hi Rich,

All the fields are getting parsed in the field extractor wizard however they are not showing up in search.

Sumit Kukreja

Re: Field Extraction is not working in Splunk.

svemurilv — Thu, 02 Mar 2017 19:40:20 GMT

Whats exact generated _raw event , past it here

Re: Field Extraction is not working in Splunk.

richgalloway — Thu, 02 Mar 2017 22:21:51 GMT

Did you save the results of the extract field wizard?

Re: Field Extraction is not working in Splunk.

skukreja — Fri, 03 Mar 2017 09:08:10 GMT

Yes I do save them and I can see them in filed extraction tab.

mscs:storage:blob : EXTRACT-Method,Status,StorageAccount,IPAddress

My save field extraction name.

Sumit Kukreja

Re: Field Extraction is not working in Splunk.

richgalloway — Fri, 03 Mar 2017 13:11:15 GMT

I can't explain why it's not working.