Splunk Search

How to use the query that Field extractor generate to use in your search

phamxuantung
Communicator

Hi, so I try to use Field Extractor (in Extract new fields) to extract some fields from raw logs to make a table. I have successfully show it on my end but other can't. So I want to apply the query that it auto generate in my own search. The query is:

^[^>\n]*>\s+\w+<(?P<Portname>[^>]+)[^:\n]*:\s+(?P<Status>\w+) at <(?P<IP>[^:]+):(?P<Port>[^>]+)

How do I apply it to Splunk search?

Labels (3)
0 Karma
1 Solution

Vardhan
Contributor

Hi @phamxuantung ,

If the fields are only visible to you but other can't .It means the extractions which you have created are in private.Make it global then others can make use of it.

If you want to put it in search then use the 

Rex command

|rex "^[^>\n]*>\s+\w+<(?P<Portname>[^>]+)[^:\n]*:\s+(?P<Status>\w+) at <(?P<IP>[^:]+):(?P<Port>[^>]+)"

If this answer helps you then upvote it.

View solution in original post

Vardhan
Contributor

Hi @phamxuantung ,

If the fields are only visible to you but other can't .It means the extractions which you have created are in private.Make it global then others can make use of it.

If you want to put it in search then use the 

Rex command

|rex "^[^>\n]*>\s+\w+<(?P<Portname>[^>]+)[^:\n]*:\s+(?P<Status>\w+) at <(?P<IP>[^:]+):(?P<Port>[^>]+)"

If this answer helps you then upvote it.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...