Fields extracted not appearing while searching

[Splunkerninja]

Hi,

I have extracted fields manually in Splunk cloud, The regex works perfectly in the field extraction preview page but while seraching fields are not showing up. I have kept the permission to global, searching in verbose mode,set the coverage to All fields. I am trying to extract 6 fields(all the regex are working in preview page)out of which only one field(IP address) is showing in search.I have debugged and refreshed the page bumped it as well.

Funny part if i use default regex expression in Splunk instead of writing my own regex then fields pops in search. Also, I have observed couple of fields showing up and then disappearing while searching

Sample data :  nCountry: United States\nPrevious Country

nCountry\:\s(?<country>.+?)\\\nPrevious\sCountry

I have referred almost all the splunk answers but none of the solution fixed my problem. I am intruiged to know why is it not working? Thanks in advance 

[danspav · Accepted solution]

Hi @Splunkerninja,

If your sample data is:

Sample data :  nCountry: United States\nPrevious Country

Can you try updating your field extraction to use:

nCountry:\s(?<country>.+?)\\nPrevious\sCountry

Only two tweaks:

• No need to escape the : character
• The text in the sample is "\n"  - we need to escape the backslash with two backslashes. If you use three that translates to a single backslash followed by a new line.