Splunk Search

Extracted fields not showing up in Interactive search

sourabhguha
Explorer

I have the following regex for an extracted field

(?i)^(?:[^,]*,){1}(?P<OM-InstanceName>[^,]+)  
(?i)^(?:[^,]*,){2}(?P<OM-ObjectName>[^,]+)  
(?i)^(?:[^,]*,){3}(?P<OM-PerfCounterDataID>[^,]+)

When I test the regex it does return the expected fields.

However, the fields do not show up in the search app (on the left side menu - next to the events list)

I have other sourcetypes with extracted fields and they work fine. The only difference for this sourcetype is that I chose the option to 'index only once' when I added the data to Splunk.

Any clues on why the extracted fields are not showing up.

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

Not too sure what you mean with the "index only once", but then I haven't really used the wizard-style way of adding data to Splunk. One thing that does look like it could be the source of your problems is that your field names contain hyphens, which at least in the past has been a problem.

Assuming that your regexes work fine in other tools, I'd suggest that you use underscore instead and call your fields;

OM_ObjectName
OM_PerfCounterDataID

etc etc

Hope this helps,

Kristian

sourabhguha
Explorer

thanks! that resolved the issue. I renamed it to OMObjectname (removed the '-', did not use underscore).

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...