Splunk Search

Fields extracted not appearing while searching

Splunkerninja
Path Finder

Hi,

I have extracted fields manually in Splunk cloud, The regex works perfectly in the field extraction preview page but while seraching fields are not showing up. I have kept the permission to global, searching in verbose mode,set the coverage to All fields. I am trying to extract 6 fields(all the regex are working in preview page)out of which only one field(IP address) is showing in search.I have debugged and refreshed the page bumped it as well.

Funny part if i use default regex expression in Splunk instead of writing my own regex then fields pops in search. Also, I have observed couple of fields showing up and then disappearing while searching

Sample data :  nCountry: United States\nPrevious Country

 

nCountry\:\s(?<country>.+?)\\\nPrevious\sCountry

 

 

I have referred almost all the splunk answers but none of the solution fixed my problem. I am intruiged to know why is it not working? Thanks in advance 

Labels (2)
0 Karma
1 Solution

danspav
SplunkTrust
SplunkTrust

Hi @Splunkerninja,

If your sample data is:

Sample data :  nCountry: United States\nPrevious Country

 

Can you try updating your field extraction to use:

nCountry:\s(?<country>.+?)\\nPrevious\sCountry

 

Only two tweaks:

  • No need to escape the : character
  • The text in the sample is "\n"  - we need to escape the backslash with two backslashes. If you use three that translates to a single backslash followed by a new line.

 

View solution in original post

0 Karma

danspav
SplunkTrust
SplunkTrust

Hi @Splunkerninja,

If your sample data is:

Sample data :  nCountry: United States\nPrevious Country

 

Can you try updating your field extraction to use:

nCountry:\s(?<country>.+?)\\nPrevious\sCountry

 

Only two tweaks:

  • No need to escape the : character
  • The text in the sample is "\n"  - we need to escape the backslash with two backslashes. If you use three that translates to a single backslash followed by a new line.

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...