Splunk Search

Field extraction tested not appearing in search

lmachetman
Explorer

I am trying to extract a field from the below logging

BBFH_SAPI=2012-10-16=11:13:14=I=05612=REQUESTS: 1220 Answered , 0 UnAnswered , 0 UnRequested , 2934 Error

The part I'm trying to extract is 1220 - which corresponds to a number of requests made.

When I Test the below in the field extractor it returns the expected result

(?i)=REQUESTS: (?P<RequestsAnswered>\d+)

However if I save the above into a field and then run a search it doesn't return the saved field (The search is being run from the App in which the field has been saved, and using the sourcetype in which the field has been defined)

Tags (3)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

Assuming you are using Splunk 6, if you go to the menu Settings->Fields->Field Extractions and then select your app context to find your extraction, you'll most likely need to enable permissions on that field. Then when you go back to look at that sourcetype again the field should appear. You may need to click on the bottom of that list where is say 'X more fields' to see it and add it to your selected Fields.

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

Assuming you are using Splunk 6, if you go to the menu Settings->Fields->Field Extractions and then select your app context to find your extraction, you'll most likely need to enable permissions on that field. Then when you go back to look at that sourcetype again the field should appear. You may need to click on the bottom of that list where is say 'X more fields' to see it and add it to your selected Fields.

lmachetman
Explorer

thank you - the fields are appearing now

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...