Splunk Search
Highlighted

Inline REX extraction not working once I move it Field Extraction

Communicator

The following gives me exactly what I want

host=****** Failed_Reason minutesago=15 | rex "\>(?<Failed_Reason>.*?)\<"

but when I use the regex to build a field extraction I cannot get a result even after restarting the indexer. The search output is the same.

The field extraction format is

"\>(?<Failed_Reason>.*?)\<"

Any idea why this is not working?

Thanks

Tags (2)
0 Karma
Highlighted

Re: Inline REX extraction not working once I move it Field Extraction

Super Champion

Have yoy tried the field extractor app? It will generate a regex for you.
It is not clear what you're asking, is this for an index time extraction?

0 Karma
Highlighted

Re: Inline REX extraction not working once I move it Field Extraction

Champion

1) Sounds like auto key=value extraction may be giving you a helping hand.

2) Your regex mentions > and < as marker characters, yet none are visible in your sample message.

3) When you move a regular expression from the search bar into transforms.conf, you'll want to remove the enclosing double-quotes.

View solution in original post

0 Karma
Highlighted

Re: Inline REX extraction not working once I move it Field Extraction

Communicator

Thanks - that makes sense. Not sure why but about 40 minutes this started working.

0 Karma
Highlighted

Re: Inline REX extraction not working once I move it Field Extraction

Communicator

thanks - the ifx was of no help at all for this issue

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.