Splunk Search

Why am I getting a "extracting multiple fields" error when try to extract fields on a log file that contains XML?

bradleycruicksh
New Member

Hi,

I am trying to do a field extraction on a log file that contains XML as below however when I try to extract the "LAR..." section I am getting the following error in the GUI:
The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.

Example of the log section below:

        <id>
          <domain>Id</domain>
          <id>LAR000000000000000000001</id>
        </id>

Can you tell me if this is possible?

Thanks

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

What is the regex for extracting the data that is causing the error? I'm assuming this is from the Field Extraction Tool.
And is the XML data much larger and you are getting more fields than the one above? More information is helpful. 🙂

0 Karma

bradleycruicksh
New Member

Hi, thanks for the response.

I am using the GUI to extract the data and that's where I see the error. Once the error occurs the GUI stops me going any further and I have to remove the extraction.

Hope this helps

Best Regards
Bradley

0 Karma

Sukisen1981
Champion

Hi,

At most times it is best to write your own regex than use the GUI, extract more fields or build a regex from event actions. Coming back to your XMl , I suspect like @cpetterborg is saying , that your XML does indeed contain more fields than just the one LAR field

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...