Why Field Extraction Stopped Working

[RowdyRodney]

Hello - I created a Field Extraction to look for a file extension. The raw log looks like this:

"FileName": "John Test File.docx"

The regex I used was:

"FileName":\s".+\.(?P<Domain>.[a-zA-Z0-9]*)

This tests out in any regex tester I use. When I first created this, I ran a search query and some of the fields populated, but some were blank. I then checked which records weren't being extracted correctly, and found the regex matched the raw log pattern, so I was unsure why it wouldn't have extracted.

However,  ~30 minutes after creating this field extraction. It stopped extracting anything. The state I'm now, I can see that each raw log record matches my extraction regex, but the fields are still empty and this isn't being extracted. Why would that be?

Each raw log matches the regex in the extraction...

[livehybrid · Accepted solution]

Hi @RowdyRodney 

How are you doing this extraction? Is it a search-time extraction in Splunk Enterprise/Cloud?

These use PCRE based Regex whereas you have provided a Python-style named capturing group (?P...) 

Please can you update this to a PCRE based regex and see if this resolves the issue?

"FileName":\s".+\.(?<Domain>.[a-zA-Z0-9]*)

Can I also check, is the intention that it matches the file extension (docx) in your sample data?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[RowdyRodney]

Thank you that helped!