Splunk Dev

Field Extractor Utility: Why am I getting error "The extraction failed. If you are extracting multiple fields, try removing one or more fields..."?

carlyleadmin
Contributor

Splunk version 6.2.3

hi all,

i know there are alot of questions/answers like thialt textt and neither one of them tells you what the issue is and just give you the resolution.so i thought maybe someone can do the same for me:)though i would like to know why this is failing.

Attached is the screenshot where i would like to extract those highlighted field as "ILM".i select one sample and create ILM but it would not extract the other fields like the one highlighted automatically on other samples,so i select another one, select the field try to tag it as "ILM" and i get an error.

pattern is same where there is an error log with explanation what is going on(like the highlighted field).can i anyone tell me why this one errors out?

i extracted other fields where selected field picks up automatically across the other samples and works like charm but here,it is driving me crazy.

Any help is greatly appreciated

Tags (1)
0 Karma

JDukeSplunk
Builder

I use this one for a manual regex a good bit when the string I want is always preceded by a certain string.

|yourbasesearch | rex field=_raw "null - <fieldname>.*)"

You may have to "escape" the dash with either one or two .
I don't know how good this is, but it seems to work for me.

0 Karma

deepashri_123
Motivator

Hey carlyleadmin,

It is a better approach if you write your regex manually.
Alternatively, try field extractor to extract fields in parts and extract not more than 2 or 3 fields at a time.

Hope this helps!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The field extractor is probably coming up with regular expression that is too complex. When this happens to me I just write the regex manually. Actually, I almost always write my own regular expressions since they tend to be simpler than what the wizard creates.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...