Dashboards & Visualizations

Why is extracted field not visible in 'Search and Reporting'?

sayanideypal
Engager

Hey, 

I can see the newly added field extraction regex in my field extraction page. But, the same field is not available in the Search page 

sayanideypal_1-1685446309252.png

 

sayanideypal_0-1685446267202.png

 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sayanideypal,

I suppose that you manually created the field extraction, because this is the rex command but the field extraction is just a little different, in your case the regex to insert in the field extraction form is:

gluu-(?<instance>[^\-]+) in podName

 in other words: you have to insert the regex and at the end, using the "in" you can define that the extraction must be done on the podName field.

Ciao.

Giuseppe

sayanideypal
Engager

Hi @gcusello 

The regex I added is as below:

rex field=podName "gluu-(?P<instance>[^\-]+)-"

 

this works find when added in search bar.

Thank you for taking the time!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sayanideypal,

yes this is the command to insert in your searches that must be used to test the regex itself.

but to have a permanent field extraction, you have to put the regex (not the rex command) in the field extractions form.

The option field=podName can be used adding the "in podName" option at the end of the regex.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...