Automatic field extraction is failing for one field

[omgwut56k]

I have a field value named 'category' the raw values are for example.

"Audit Global - ABC - Login and Logout Audit"
"Audit Global - ABC - Login - SQL Exception"

When searching, the values for category are returned as only 'Audit' or the first 5 characters of the raw value. The field extraction is not working correctly for this field.

Any ideas on what to look at?

Thank you

[jeffland · Accepted solution]

This can be done pretty easily if you know when the value ends, i.e. if you know these values are enclosed in some special characters (like category="audit global ... exception") or if you know how the next field name is (like category=audit global ... exception next_field=). For the first case, define an EXTRACT-category in props.conf with the regular expression

category="(?<category>[^"]*?)"

or for the second do something like

category=(?<category>.+?)\s+new_field

See here for the documentation on how to do those extractions.

[omgwut56k]

Perfect! Thank you.

[gyslainlatsa]

hi,
please can you rephrase your question? because I do not compends you well

[omgwut56k]

I have edited the original question, let me know if that helps.
Thank you,

[woodcock]

Show us your configuration files and your Knowledge Objects.

[omgwut56k]

Hi Woodcock, I've re-phrased my question, it might not have been phrased very clearly.

props only contains a couple of unrelated field extractions and no transforms. Is there something specific you are interested in?