Splunk Search
Highlighted

New field created through field transformation not appearing in search results

New Member

I have created a field called PROCESS via Fields » Field transformations

alt text

I could not see in the field appear in the search results.

Also, I could not set up a field using Field extractions as it only works on data _raw field.

0 Karma
Highlighted

Re: New field created through field transformation not appearing in search results

Builder

Try this for your regular expression:

\/flcc-logs\/(?<PROCESS>[^\/]+)

You can also do this "live" as part of your search:

(your search)
| rex "\/flcc-logs\/(?<PROCESS>[^\/]+)"
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.