Knowledge Management

How do I include samples that did not highlight my extracted field?

wuming79
Path Finder

Hi,

I'm trying to extract a field call Priority and I have highlighted a sample of it. Upon validate, I realized there are some rows that did not hightlight "Priority: 3" and these rows has a red cross on the left (see picture below). I'm not sure what it means. Can someone please help to explain? i can't find examples from documentation on this.

alt text

Tags (1)
0 Karma

wuming79
Path Finder

Hi somsoni2,

Today I search my snort stream, I can find new formats. Priority 3 has 2 different events and there are also priority 0 and 2 but I could not find priority 1. If priority 1 is currently not available, can we still extract it as priority in advance?

Below is my regex for priority: 0
^(?:[^]\n]*]){3}\s+[(?P\w+:\s+\d+)

Here's a screenshot of how it looks when I add sample to extraction.
alt text
alt text

0 Karma

somesoni2
Revered Legend

It means that the regular expression which the IFX came up with didn't match for those two events. If you see closes, you can see those two events have additional text after ICMP PING on line 1 (*NIX), which may be causing Splunk regex to fail. Your best option would be to update the regular expression manually (click on "Show regular expression" and then edit regular expression). If you can paste what regex you see there (do remember to format it using Ctrl+K or cliking on 101010 button), we can help fixing that.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...