Splunk Search

Field extraction is having issue for a value

shubhamnyaik
Explorer

a

Tags (1)
0 Karma

mayurr98
Super Champion

hey @shubhamnyaik
Try this:

index=your_index | rex field=_raw "<(businessChannel|ns1:businessChannel)>(?P<businessChannel>[^\<]*)"

let me know if it helps!
Also, your log does not contain this fields please give us proper sample log.

0 Karma

niketn
Legend

@shubhamnyaik, you would need to post your data using code button 101010 here on Splunk Answers so that special characters do not escape.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...