Splunk Search

Why am I unable to filter log data from extracted fields?

Manideep
Loves-to-Learn Lots

scenario : - I had a log file. I am able to extract the fields from the log event and also see the data in the extracted fields. But when I am filtering the data with use of extracted field, unable to see the results although it has data in the extracted field. 

I have referred to this "http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/" link it doesn't help. 

Please help us regarding this.

Labels (3)
0 Karma

Manideep
Loves-to-Learn Lots

My query  |  rex field=_raw "(?msi)(?<SiteId>(?<=SiteId:).+?(?<=\n))" | spath input=SiteId

with the above query i am able to see the values under "SiteId" fields

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Manideep,

I assume that the regex correctly extracts values.

the field name is exactly "SiteId" or there's something before?

are you shure about the case of the letters in the field name? values aren't case sensitive but field names are case sensitive.

Then, having you a regex, why do you use spath?

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Manideep,

could you share your not working search?

ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...