Splunk Search

Field extraction tested not appearing in search

Explorer

I am trying to extract a field from the below logging

BBFH_SAPI=2012-10-16=11:13:14=I=05612=REQUESTS: 1220 Answered , 0 UnAnswered , 0 UnRequested , 2934 Error

The part I'm trying to extract is 1220 - which corresponds to a number of requests made.

When I Test the below in the field extractor it returns the expected result

(?i)=REQUESTS: (?P<RequestsAnswered>\d+)

However if I save the above into a field and then run a search it doesn't return the saved field (The search is being run from the App in which the field has been saved, and using the sourcetype in which the field has been defined)

Tags (3)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Assuming you are using Splunk 6, if you go to the menu Settings->Fields->Field Extractions and then select your app context to find your extraction, you'll most likely need to enable permissions on that field. Then when you go back to look at that sourcetype again the field should appear. You may need to click on the bottom of that list where is say 'X more fields' to see it and add it to your selected Fields.

View solution in original post

Splunk Employee
Splunk Employee

Assuming you are using Splunk 6, if you go to the menu Settings->Fields->Field Extractions and then select your app context to find your extraction, you'll most likely need to enable permissions on that field. Then when you go back to look at that sourcetype again the field should appear. You may need to click on the bottom of that list where is say 'X more fields' to see it and add it to your selected Fields.

View solution in original post

Explorer

thank you - the fields are appearing now

0 Karma