Splunk Search

How to use the query that Field extractor generate to use in your search

phamxuantung
Communicator

Hi, so I try to use Field Extractor (in Extract new fields) to extract some fields from raw logs to make a table. I have successfully show it on my end but other can't. So I want to apply the query that it auto generate in my own search. The query is:

^[^>\n]*>\s+\w+<(?P<Portname>[^>]+)[^:\n]*:\s+(?P<Status>\w+) at <(?P<IP>[^:]+):(?P<Port>[^>]+)

How do I apply it to Splunk search?

Labels (3)
0 Karma
1 Solution

Vardhan
Contributor

Hi @phamxuantung ,

If the fields are only visible to you but other can't .It means the extractions which you have created are in private.Make it global then others can make use of it.

If you want to put it in search then use the 

Rex command

|rex "^[^>\n]*>\s+\w+<(?P<Portname>[^>]+)[^:\n]*:\s+(?P<Status>\w+) at <(?P<IP>[^:]+):(?P<Port>[^>]+)"

If this answer helps you then upvote it.

View solution in original post

Vardhan
Contributor

Hi @phamxuantung ,

If the fields are only visible to you but other can't .It means the extractions which you have created are in private.Make it global then others can make use of it.

If you want to put it in search then use the 

Rex command

|rex "^[^>\n]*>\s+\w+<(?P<Portname>[^>]+)[^:\n]*:\s+(?P<Status>\w+) at <(?P<IP>[^:]+):(?P<Port>[^>]+)"

If this answer helps you then upvote it.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...