Why is my extracted field not showing up in search result

[arpitpropay]

I have several log files as source of Splunk events.

C:\logs\Srv1\file1_2019-05-06.log
C:\logs\Srv84\file3_2019-05-06.log
C:\logs\Glob9\file18_2019-05-06.log

I am trying to extract the immediate parent directory name from the source field of events. So in a custom extracted field "appname", I am hoping to get values Srv1, Srv84 and Glob9 from examples above.

Here's what I am doing.

Splunk Web > Settings > Fields > Fields Extractions > Add new

Destination app: search
Name: source_app_name
Apply to: source named: app_name
Type: Inline
Extraction/Transform: ^.+\x5C(?<appname>(.+))\x5C[^\x5C]*$

Sharing: Global, All apps, Read permission to everyone.

When I run my search ...| extract reload=t I can't find appname field in All fields. All fields is selected in the Select field list.

Am I doing anything wrong with my field extraction, or with my search?

[vishaltaneja070 · Accepted solution]

Hello @arpitporpay

The best way to do this is:
Go to Splunk Web > Settings > Fields > Fields Extractions > Add new

then add the below attributes:

app_name: <your app name>
name: source_app_name
sourcetype : < as per your requirement>  --- the above mentioned source is incorrect as it is asking for which source it need to apply so it is better to use sourcetype.
Type: uses trasform
extraction: appname

Go to Splunk Web > Settings > Fields > Field transformations > Add new

destination_app: <your app name>
name : appname
type: regex-based
regular expression: ^.+\x5C(?<appname>(.+))\x5C[^\x5C]*$
source_key : source

Thanks!

[vishaltaneja070]

Otherwise:

props.conf

[your_sourcetype]
REPORT-appname1= appname

transforms.conf
[appname]
REGEX= ^.+\x5C(?(.+))\x5C[^\x5C]*$
SOURCE_KEY = source

[vishaltaneja070]

@arpitpropay : Could you please accept the answer to close the conversation.

[arpitpropay]

Thanks @vishaltaneja07011993 your solution (using field transformation in field extraction) worked for me.