IFX Field Extraction issue

[ebailey]

I have the following event (see bottom of the post) and I need help extracting various fields and I am not having much luck. I thought this would be simple but it is not working

I want to extract the following in the IFX - NOONE_Mainframe_Diff: 0000.42,

I entered "NOONE_Mainframe_Diff: 0000.42," as an example event and get no matches. I want to use NOONE_Mainframe_Diff as the field. So

But I consistantly get no matching events. The regex looks right so I am not sure what todo

Thanks

Ed

Jun 27 10:58:30 xxxxxxx Jun 27 10:58:30 xxxxxxx SSG[113]: WARNING xxxxxxxxxx: -5: NOONE_Start,NOONE_Company Name: xxxxxxx,NOONE_Authenticated User: xxxxxxx,NOONE_Date: 06/27/2013 10:58:30:475,NOONE_RQST_IP_ADDR_TXT:xx.xx.xx.xxx,NOONE_Cert_Serial:354395681957994794320759,NOONE_LDAP_2factor: TRUE,NOONE_XML_FORM_FLG: N,NOONE_ISUB_NUM: 00001788,NOONE_ISUB_PFX_CDE: 06CH,NOONE_PRDT_CDE: 07000,NOONE_KOB_CDE: A ,NOONE_Formatfail: ,NOONE_Pre_CompleteTransaction: 1,NOONE_Post_CompleteTransaction: 470,NOONE_Complete_Transaction: 469.0,NOONE_HTTP_Routing: 419,NOONE_Mainframe_Start: 10:58:30:51,NOONE_Mainframe_End: 10:58:30:93,NOONE_Mainframe_Diff: 0000.42,NOONE_Cert_Bind_Latency: 4.0,NOONE_LDAP_Query_Latency: 3.0,NOONE_LDAPQuery2_Latency: 2.0,NOONE_IPLDAPQuery_Latency: 2.0,NOONE_trusubcodeLDAPQuery_Latency: ,NOONE_truoldsubcodeLDAPQuery_Latency: ,NOONE_LDAP_Bind_Latency: 27.0,NOONE_vendorname: ,NOONE_errorcode: ,NOONE_countrycode: 1,NOONE_softtethering: N,NOONE_twofactorenabled: 2,NOONE_UserReference_CDE: IBAIBAIBAIBAIBAIBAIBAIBA,NOONE_End

[MHibbin]

Hi there,

It may have been helpful to see the regex that the IFX was generating.

You could try the following for your example listed:

(?i)noone\_mainframe\_end:\s+(?P<mainDiff>[^,]+)

You should use http://gskinner.com/RegExr" for help with testing regex.

You may want to look at configuring field extractions based on a delimiter (e.g. ", ").

http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Createandmaintainsearch-timefieldextract...