Splunk Search

How to extract fields from regex and put in a table

splunkuser2127
Loves-to-Learn

My current search is:

 

index=rtm* source=/prod/msp/logs/private-auto-loan-credit* | regex "The rule (?<field1>[a-zA-Z0-9]+_[a-zA-Z0-9]+)_(?<field2>[a-zA-Z0-9]+) with" | table field1, field2

 

In verbose mode, it finds the correct entries, but my table is full of nulls. What am I doing wrong? 

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

can you share example events so the community could help you. 
You should change regex to rex and try again. 
r. Ismo

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...