In line rex not working once moved to Field Extraction

[borisalves]

Sample log entry:

23:36:15 '99.999.999.999' GET /downloads//999/SomeProduct/GetComponent/Foo.exe 'Private Message' 200 5814120 19.391

Query:

"Private Message" | rex "(?<httpTimeStamp>\d\d\:\d\d\:\d\d) \'(?<httpClientIp>\d*\.\d*\.\d*\.\d*)\' (?<httpMethod>\w*) (?<httpUri>[^ ]*) \'CitrixOnline Installer-Downloader\' (?<httpResponseCode>\d+) (?<httpBytesDownloaded>[0-9\-]*) (?<httpDownloadTime>[0-9\.]*)" 

In line this rex works exactly as I would expect. Because i do not want to type that out every time i need info on http I added to Manager >> Fields >> Field extractions.

It looks like this on the Field Extractions browser:

http : EXTRACT-SomeName  Inline  "(?<httpTimeStamp>\d\d\:\d\d\:\d\d) \'(?<httpClientIp>\d*\.\d*\.\d*\.\d*)\' (?<httpMethod>\w*) (?<httpUri>[^ ]*) \'Private Message\' (?<httpResponseCode>\d+) (?<httpBytesDownloaded>[0-9\-]*) (?<httpDownloadTime>[0-9\.]*)"

I checked props.conf and everything looks alright.

What might i be missing?

[rsennett_splunk · Accepted solution]

As you mentioned: Field Discovery was set to "OFF"

Field discovery is the process Splunk uses to extract fields aside from default fields such as host, source, and sourcetype. This means that Splunk only returns information on default fields and fields that are required to fulfill your search (if you are searching on certain fields, it will extract those fields).

so you must include
| fields httpTimeStamp, httpClientIp, httpMethod, httpUri, httpResponseCode, httpBytesDownloaded, httpDownloadTime

or mention them in some other explicit way in order for Splunk to extract them when Field Discovery is off.

If you were testing with just the sourcetype or with * you wouldn't have seen them.