- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to extract a field from the below logging
BBFH_SAPI=2012-10-16=11:13:14=I=05612=REQUESTS: 1220 Answered , 0 UnAnswered , 0 UnRequested , 2934 Error
The part I'm trying to extract is 1220 - which corresponds to a number of requests made.
When I Test the below in the field extractor it returns the expected result
(?i)=REQUESTS: (?P<RequestsAnswered>\d+)
However if I save the above into a field and then run a search it doesn't return the saved field (The search is being run from the App in which the field has been saved, and using the sourcetype in which the field has been defined)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Assuming you are using Splunk 6, if you go to the menu Settings->Fields->Field Extractions and then select your app context to find your extraction, you'll most likely need to enable permissions on that field. Then when you go back to look at that sourcetype again the field should appear. You may need to click on the bottom of that list where is say 'X more fields' to see it and add it to your selected Fields.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Assuming you are using Splunk 6, if you go to the menu Settings->Fields->Field Extractions and then select your app context to find your extraction, you'll most likely need to enable permissions on that field. Then when you go back to look at that sourcetype again the field should appear. You may need to click on the bottom of that list where is say 'X more fields' to see it and add it to your selected Fields.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thank you - the fields are appearing now
