Splunk Search
Highlighted

Inline REX extraction not working once I move it Field Extraction

Communicator

The following gives me exactly what I want

host=****** Failed_Reason minutesago=15 | rex "\>(?<Failed_Reason>.*?)\<"

but when I use the regex to build a field extraction I cannot get a result even after restarting the indexer. The search output is the same.

The field extraction format is

"\>(?<Failed_Reason>.*?)\<"

Any idea why this is not working?

Thanks

Tags (2)
0 Karma
Highlighted

Re: Inline REX extraction not working once I move it Field Extraction

Super Champion

Have yoy tried the field extractor app? It will generate a regex for you.
It is not clear what you're asking, is this for an index time extraction?

0 Karma
Highlighted

Re: Inline REX extraction not working once I move it Field Extraction

Champion

1) Sounds like auto key=value extraction may be giving you a helping hand.

2) Your regex mentions > and < as marker characters, yet none are visible in your sample message.

3) When you move a regular expression from the search bar into transforms.conf, you'll want to remove the enclosing double-quotes.

View solution in original post

0 Karma
Highlighted

Re: Inline REX extraction not working once I move it Field Extraction

Communicator

Thanks - that makes sense. Not sure why but about 40 minutes this started working.

0 Karma
Highlighted

Re: Inline REX extraction not working once I move it Field Extraction

Communicator

thanks - the ifx was of no help at all for this issue

0 Karma