Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Re: Field Extractraction problem ??
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi .
I have written the following regex in my query , then it is working fine but when i am trying to create this regex expression in the field extractor it is not coming in the query.
My regex expression ::
(?
Query Used after creating field extractor ::
Sourcetype="mydata" | top Test
but this is not workin ..Please help ..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First, the names of fields are case-sensitive. You created a field named "test" but then your top command used a field called "Test". That's never going to work.
Second, although your regular expression may be legal, I would have written it:
(?im)(?<test>"(?:Request|Response)")
I have noticed that Splunk is sometimes finicky about non-capturing parenthesis; this regular expression is a bit clearer. And are the quotation marks actually in the data? Do you really need them for the regular expression?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First, the names of fields are case-sensitive. You created a field named "test" but then your top command used a field called "Test". That's never going to work.
Second, although your regular expression may be legal, I would have written it:
(?im)(?<test>"(?:Request|Response)")
I have noticed that Splunk is sometimes finicky about non-capturing parenthesis; this regular expression is a bit clearer. And are the quotation marks actually in the data? Do you really need them for the regular expression?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No quotation marks are not need lginn .. thnx for the regular expression .this worked for me..:)
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Catalog Is Now Generally Available on Splunk Cloud Platform
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner
