Splunk Search

Problem Creating new search time field extraction Thru the REST API and Java Splunk SDK

misteryuku
Communicator

I have a problem creating new search time field extractions using the Splunk's REST API and the Java SDK.

This is the java code.
RequestMessage reqMsg = new RequestMessage();
reqMsg.setMethod("post");
reqMsg.setContent("name=firstname&stanza=sexuality&type=EXTRACT&value=(?i)^[^,]*,\w+=(?P[^,]+)");

ResponseMessage resMsg = authService.send("/servicesNS/admin/search/data/props/extractions",reqMsg);

The result was an error :
HTTP 500 -- In handler 'props-extract': Data could not be written: /admin/search/props/sexuality/EXTRACT-firstname: (?i)^[^,]*,\w

How do i fix this so that i can create a new search time field extraction through the REST API using Java ?? and i also cannot create the extraction on the IFX the error still persists.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...