Extracted fields not showing up in Interactive search

[sourabhguha]

I have the following regex for an extracted field

(?i)^(?:[^,]*,){1}(?P<OM-InstanceName>[^,]+)  
(?i)^(?:[^,]*,){2}(?P<OM-ObjectName>[^,]+)  
(?i)^(?:[^,]*,){3}(?P<OM-PerfCounterDataID>[^,]+)

When I test the regex it does return the expected fields.

However, the fields do not show up in the search app (on the left side menu - next to the events list)

I have other sourcetypes with extracted fields and they work fine. The only difference for this sourcetype is that I chose the option to 'index only once' when I added the data to Splunk.

Any clues on why the extracted fields are not showing up.

[kristian_kolb]

Not too sure what you mean with the "index only once", but then I haven't really used the wizard-style way of adding data to Splunk. One thing that does look like it could be the source of your problems is that your field names contain hyphens, which at least in the past has been a problem.

Assuming that your regexes work fine in other tools, I'd suggest that you use underscore instead and call your fields;

OM_ObjectName
OM_PerfCounterDataID

etc etc

Hope this helps,

Kristian

[sourabhguha]

thanks! that resolved the issue. I renamed it to OMObjectname (removed the '-', did not use underscore).