Field Extractraction problem ??

[rakesh_498115]

Hi .

I have written the following regex in my query , then it is working fine but when i am trying to create this regex expression in the field extractor it is not coming in the query.

My regex expression ::

(?(?im)"(Request|Response)")

Query Used after creating field extractor ::

Sourcetype="mydata" | top Test

but this is not workin ..Please help ..

[lguinn2 · Accepted solution]

First, the names of fields are case-sensitive. You created a field named "test" but then your top command used a field called "Test". That's never going to work.

Second, although your regular expression may be legal, I would have written it:

(?im)(?<test>"(?:Request|Response)") 

I have noticed that Splunk is sometimes finicky about non-capturing parenthesis; this regular expression is a bit clearer. And are the quotation marks actually in the data? Do you really need them for the regular expression?

[rakesh_498115]

No quotation marks are not need lginn .. thnx for the regular expression .this worked for me..:)