Splunk Search

How to include Field Extraction name in Splunk search?

friscos
Explorer

Hi,

I have extracted a transaction id using field extraction.

Field Extraction Name: BANK_APPLOG : EXTRACT-TransID
RegEx: ^(?:[^>\n]*>){4}(?P<TransID>\w+)

How do i include this field extraction name in the search so that I can retrieve all the transaction ids.

Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Index=ABC (sourcetype=ghi, source=def if needed) TransID |table TransID, _raw

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

friscos
Explorer

I tried index=main sourcetype=BANK_APPLOG TransID | table TransID, _raw but this did not return any results.

0 Karma

gcusello
SplunkTrust
SplunkTrust

If you completed the field extraction and saved it you can use the field in your searches.
Otherwise you could use it adding a command

rex "^(?:[^>\n]*>){4}(?P<TransID>\w+)"

and use it.
Bye.
Giuseppe

0 Karma

friscos
Explorer

I have tried this but this retrieves all the events and not by transaction id.

index=main sourcetype=BANK_APPLOG |  rex "^(?:[^>\n]*>){4}(?P<TransID>\w+)"
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...