Field Extractor Utility: Why am I getting error "The extraction failed. If you are extracting multiple fields, try removing one or more fields..."?

[carlyleadmin]

Splunk version 6.2.3

hi all,

i know there are alot of questions/answers like thit and neither one of them tells you what the issue is and just give you the resolution.so i thought maybe someone can do the same for me:)though i would like to know why this is failing.

Attached is the screenshot where i would like to extract those highlighted field as "ILM".i select one sample and create ILM but it would not extract the other fields like the one highlighted automatically on other samples,so i select another one, select the field try to tag it as "ILM" and i get an error.

pattern is same where there is an error log with explanation what is going on(like the highlighted field).can i anyone tell me why this one errors out?

i extracted other fields where selected field picks up automatically across the other samples and works like charm but here,it is driving me crazy.

Any help is greatly appreciated

[JDukeSplunk]

I use this one for a manual regex a good bit when the string I want is always preceded by a certain string.

|yourbasesearch | rex field=_raw "null - <fieldname>.*)"

You may have to "escape" the dash with either one or two .
I don't know how good this is, but it seems to work for me.

[deepashri_123]

Hey carlyleadmin,

It is a better approach if you write your regex manually.
Alternatively, try field extractor to extract fields in parts and extract not more than 2 or 3 fields at a time.

Hope this helps!!

[richgalloway]

The field extractor is probably coming up with regular expression that is too complex. When this happens to me I just write the regex manually. Actually, I almost always write my own regular expressions since they tend to be simpler than what the wizard creates.