Splunk Search

How to include Field Extraction name in Splunk search?

friscos
Explorer

Hi,

I have extracted a transaction id using field extraction.

Field Extraction Name: BANK_APPLOG : EXTRACT-TransID
RegEx: ^(?:[^>\n]*>){4}(?P<TransID>\w+)

How do i include this field extraction name in the search so that I can retrieve all the transaction ids.

Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Index=ABC (sourcetype=ghi, source=def if needed) TransID |table TransID, _raw

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

friscos
Explorer

I tried index=main sourcetype=BANK_APPLOG TransID | table TransID, _raw but this did not return any results.

0 Karma

gcusello
SplunkTrust
SplunkTrust

If you completed the field extraction and saved it you can use the field in your searches.
Otherwise you could use it adding a command

rex "^(?:[^>\n]*>){4}(?P<TransID>\w+)"

and use it.
Bye.
Giuseppe

0 Karma

friscos
Explorer

I have tried this but this retrieves all the events and not by transaction id.

index=main sourcetype=BANK_APPLOG |  rex "^(?:[^>\n]*>){4}(?P<TransID>\w+)"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...