Splunk Search

Fields extracted not appearing while searching

Splunkerninja
Path Finder

Hi,

I have extracted fields manually in Splunk cloud, The regex works perfectly in the field extraction preview page but while seraching fields are not showing up. I have kept the permission to global, searching in verbose mode,set the coverage to All fields. I am trying to extract 6 fields(all the regex are working in preview page)out of which only one field(IP address) is showing in search.I have debugged and refreshed the page bumped it as well.

Funny part if i use default regex expression in Splunk instead of writing my own regex then fields pops in search. Also, I have observed couple of fields showing up and then disappearing while searching

Sample data :  nCountry: United States\nPrevious Country

 

nCountry\:\s(?<country>.+?)\\\nPrevious\sCountry

 

 

I have referred almost all the splunk answers but none of the solution fixed my problem. I am intruiged to know why is it not working? Thanks in advance 

Labels (2)
0 Karma
1 Solution

danspav
SplunkTrust
SplunkTrust

Hi @Splunkerninja,

If your sample data is:

Sample data :  nCountry: United States\nPrevious Country

 

Can you try updating your field extraction to use:

nCountry:\s(?<country>.+?)\\nPrevious\sCountry

 

Only two tweaks:

  • No need to escape the : character
  • The text in the sample is "\n"  - we need to escape the backslash with two backslashes. If you use three that translates to a single backslash followed by a new line.

 

View solution in original post

0 Karma

danspav
SplunkTrust
SplunkTrust

Hi @Splunkerninja,

If your sample data is:

Sample data :  nCountry: United States\nPrevious Country

 

Can you try updating your field extraction to use:

nCountry:\s(?<country>.+?)\\nPrevious\sCountry

 

Only two tweaks:

  • No need to escape the : character
  • The text in the sample is "\n"  - we need to escape the backslash with two backslashes. If you use three that translates to a single backslash followed by a new line.

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...