Splunk Search

Field Extraction and Search Not Syncing Properly

New Member

I am having a problem where I can extract a field, but when using that field in the search it will not return results. I believe I have narrowed the problem down to being an issue with me removing part of the word that is unneeded (it is the same on each field).

Here is an example:

^.*Test(?<extracted>[^:]).*$

TestOne returns 'One', TestTwo returns 'Two', etc.

But when I search using extracted it will fail unless I do one of the following (which both I would prefer to avoid):

Change the regex:

^.*(?<extracted>Test[^:]).*$

TestOne returns 'TestOne', TestTwo returns 'TestTwo', etc.

Add a wildcard at the front of the search: extracted="*One" to get all 'TestOne'

0 Karma
1 Solution

Legend

You're probably seeing the effects of what is described here: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Basically Splunk breaks down event data into individual segments and uses those for searching. When you define extractions that do not correspond to any segment Splunk won't find anything.

View solution in original post

0 Karma

Legend

You're probably seeing the effects of what is described here: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Basically Splunk breaks down event data into individual segments and uses those for searching. When you define extractions that do not correspond to any segment Splunk won't find anything.

View solution in original post

0 Karma

New Member

I was incorrect. I had changed the regex temporarily so that the reports would work correctly and forgot to change them back for the test. Thanks!

0 Karma

New Member

I don't believe this is the answer. In the document it says that I should be able to search using Myfield="*" | search="Valid" and it would work. However, this doesn't work for mine either.

Edit: Just wanted to clarify, this isn't necessarily wrong. I just think there is more to the answer as the test still fails for me.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!