Field Extraction question - Capturing GUID

[rewritex]

I'm still quite new to Splunk so my wording may be a little off. I am running into an issue when trying to create a field extraction for a GUID. My logs are consistent in that the GUID is always proceeded with "z8UserGUID: " and the end of the line is a whitespace. The GUID can be literally NULL and also changes in length/size but always delaminated with – hyphen. So I've just created a regex to capture the line instead of being specific to the character.

Expression: /bz8UserGuid:/s+/K/S+ ( I had to switch the backslash to a forward slash to make this post)
Test String: z8UserGuid: 5PZ3PL8W-2ZD-D1LW4VZ0FD-WZ1MV2LT2MLW4VZ

My issue is I can't seem to get the field to populate into the fields section of the search screen.
I will eventually need to figure out how to create advanced search strings and how to utilize this new knowledge into creating dashboards.

I’ve tried to add it in at the source type configuration area, the add_new_field area and the Interactive Field Extractor (IFE) but it’s still not popping up in the field list. Additionally I’ve also tried to add a capture group and non_capture group tag into the expression to no avail.
So I’m thinking I need to do something more or different …. Any ideas?

[somesoni2 · Accepted solution]

First, For posting an expression correctly, select the expression and click on 101|010 button just above the text area.
Second, try your regex in the search first, like below to check if the regex is working fine. THen you can either user IFX and provide this regex OR go to Settings->Fields->Field extractions and add it there. Do remember to update the sharing appropriately for it.

your base search | rex field=_raw "z8UserGuid:\s*(?<UserGUID>\S+)"

[rewritex]

Thank You! Things are now working as expected.