Field extraction tested not appearing in search

[lmachetman]

I am trying to extract a field from the below logging

BBFH_SAPI=2012-10-16=11:13:14=I=05612=REQUESTS: 1220 Answered , 0 UnAnswered , 0 UnRequested , 2934 Error

The part I'm trying to extract is 1220 - which corresponds to a number of requests made.

When I Test the below in the field extractor it returns the expected result

(?i)=REQUESTS: (?P<RequestsAnswered>\d+)

However if I save the above into a field and then run a search it doesn't return the saved field (The search is being run from the App in which the field has been saved, and using the sourcetype in which the field has been defined)

[sdaniels · Accepted solution]

Assuming you are using Splunk 6, if you go to the menu Settings->Fields->Field Extractions and then select your app context to find your extraction, you'll most likely need to enable permissions on that field. Then when you go back to look at that sourcetype again the field should appear. You may need to click on the bottom of that list where is say 'X more fields' to see it and add it to your selected Fields.

[lmachetman]

thank you - the fields are appearing now