How do I include samples that did not highlight my extracted field?

[wuming79]

Hi,

I'm trying to extract a field call Priority and I have highlighted a sample of it. Upon validate, I realized there are some rows that did not hightlight "Priority: 3" and these rows has a red cross on the left (see picture below). I'm not sure what it means. Can someone please help to explain? i can't find examples from documentation on this.

[wuming79]

Hi somsoni2,

Today I search my snort stream, I can find new formats. Priority 3 has 2 different events and there are also priority 0 and 2 but I could not find priority 1. If priority 1 is currently not available, can we still extract it as priority in advance?

Below is my regex for priority: 0
^(?:[^]\n]*]){3}\s+[(?P\w+:\s+\d+)

Here's a screenshot of how it looks when I add sample to extraction.

[somesoni2]

It means that the regular expression which the IFX came up with didn't match for those two events. If you see closes, you can see those two events have additional text after ICMP PING on line 1 (*NIX), which may be causing Splunk regex to fail. Your best option would be to update the regular expression manually (click on "Show regular expression" and then edit regular expression). If you can paste what regex you see there (do remember to format it using Ctrl+K or cliking on 101010 button), we can help fixing that.