Splunk Search

Why am I not getting results running a search on an extracted field?

gcusello
SplunkTrust
SplunkTrust

Hi at all,

I have a very strange behavior in one of my searches:

  • I extracted a field from a raw as a part of a word: 2016-04-13 12.12.45 ZZ1234567890123456789 and I need to take only the first 8 letters after the date ZZ123456;
  • I use the following regex ^.{20}(?\w{8}). It runs and I can extract my field and show it in my tables.

The problem is when I want to search using my field because if i write:

  index=xxx sourcetype=xxx Myfield="ZZ123456"

I don't get any results.

If I instead write:

  index=xxx sourcetype=xxx | search Myfield="ZZ123456"

I find the correct log.

The problem seems to be in the field extraction because if I extract the full string ^.{20}(?\w{21}), the search runs in both the situations, but if I want to use only a part of it, the search doesn't run.

Now I'm modifying all my searches, but it's a long job that I'd like to avoid.

Anyone has an idea of how to intervene?

Thank you in advance.

Bye.

Giuseppe

0 Karma
1 Solution

twinspop
Influencer

twinspop
Influencer

See this blog post for a good explanation on why this happens.

http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

meenal901
Communicator

Hi Giussepe,

Your field extraction looks good. When you extract using 21 characters and run the search "index=xxx sourcetype=xxx", do you already have a field called "Myfield" in the interesting fields list? If yes, then it means your extraction is already saved in the props.conf of the search head.
If not, then this is a weird case of rex :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...