Getting Data In
Highlighted

Props.conf extractions

Contributor

Any reason why my statement for props.conf isn't showing up as an extracted field?

EXTRACT-klserror = (?(klserror_*)\w+)

When I use just the rex in a search it gets the exact info that I need but when I am trying to create an extracted field it cannot

0 Karma
Highlighted

Re: Props.conf extractions

SplunkTrust
SplunkTrust

Does it work if you run it in an ad-hoc search and is it just the format or are you missing a capturing group name?

0 Karma
Highlighted

Re: Props.conf extractions

Motivator

I believe you are missing group name like MuS suggested. Try this

EXTRACT-kls_error = (?<kls_error>kls\_error\_[\w]+)
------------
Hope I was able to help you. If so, an upvote would be appreciated.

View solution in original post

Highlighted

Re: Props.conf extractions

SplunkTrust
SplunkTrust

@diogofgm is correct, you need to put <NAME> in your expression

For troubleshooting, you could try the extraction via rex in the search bar to test it and see if it works

... | rex (?<kls_error>kls\_error\_[\w]+)

0 Karma