Dashboards & Visualizations

Why is extracted field not visible in 'Search and Reporting'?

sayanideypal
Engager

Hey, 

I can see the newly added field extraction regex in my field extraction page. But, the same field is not available in the Search page 

sayanideypal_1-1685446309252.png

 

sayanideypal_0-1685446267202.png

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sayanideypal,

I suppose that you manually created the field extraction, because this is the rex command but the field extraction is just a little different, in your case the regex to insert in the field extraction form is:

gluu-(?<instance>[^\-]+) in podName

 in other words: you have to insert the regex and at the end, using the "in" you can define that the extraction must be done on the podName field.

Ciao.

Giuseppe

sayanideypal
Engager

Hi @gcusello 

The regex I added is as below:

rex field=podName "gluu-(?P<instance>[^\-]+)-"

 

this works find when added in search bar.

Thank you for taking the time!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sayanideypal,

yes this is the command to insert in your searches that must be used to test the regex itself.

but to have a permanent field extraction, you have to put the regex (not the rex command) in the field extractions form.

The option field=podName can be used adding the "in podName" option at the end of the regex.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...