Splunk Search

Error when trying to extract fields

Explorer

I currently am trying to extract the externalDropshipId from the following log

 "updatedTimestamp" : "2019-12-23T20:43:04.774Z",
  "fulfillmentOrderId" : "124B27HTRBRZC9L6P9KL7GC968",
  "externalOrderId" : "9163225842155",
  "externalDropshipId" : "6372205554",

I am using the field extractor and selecting externalDropshipID as the required text and 6372205554 as the field.

This is resulting in the following error..
The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.

How would I go about fixing this?

Thanks

0 Karma
1 Solution

Builder

try replacing the regex in the field extractor with this:

externalDropshipId\W\s:\s"(?<externalDropshipId>\d+)"

View solution in original post

Builder

try replacing the regex in the field extractor with this:

externalDropshipId\W\s:\s"(?<externalDropshipId>\d+)"

View solution in original post

Explorer

Thanks! Seems I should start learning regex's instead of relying on the Splunk extractor

0 Karma

Builder

regex101.com is a great site to test regex between that and the Splunk Quick Reference available here-->>
Splunk Quick Reference

You can get a start developing more complex field extractions than the field extractor was meant to provide.