Splunk Search

Field extraction tested not appearing in search

lmachetman
Explorer

I am trying to extract a field from the below logging

BBFH_SAPI=2012-10-16=11:13:14=I=05612=REQUESTS: 1220 Answered , 0 UnAnswered , 0 UnRequested , 2934 Error

The part I'm trying to extract is 1220 - which corresponds to a number of requests made.

When I Test the below in the field extractor it returns the expected result

(?i)=REQUESTS: (?P<RequestsAnswered>\d+)

However if I save the above into a field and then run a search it doesn't return the saved field (The search is being run from the App in which the field has been saved, and using the sourcetype in which the field has been defined)

Tags (3)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

Assuming you are using Splunk 6, if you go to the menu Settings->Fields->Field Extractions and then select your app context to find your extraction, you'll most likely need to enable permissions on that field. Then when you go back to look at that sourcetype again the field should appear. You may need to click on the bottom of that list where is say 'X more fields' to see it and add it to your selected Fields.

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

Assuming you are using Splunk 6, if you go to the menu Settings->Fields->Field Extractions and then select your app context to find your extraction, you'll most likely need to enable permissions on that field. Then when you go back to look at that sourcetype again the field should appear. You may need to click on the bottom of that list where is say 'X more fields' to see it and add it to your selected Fields.

lmachetman
Explorer

thank you - the fields are appearing now

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...