Splunk Search

Why is the field I have extracted not shown and not available for search?

WXY
Path Finder

I extracted three fields.

The data is \\VMMSNEWPALM2SER\Process(TIDC.Imports)\% Privileged Time, ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0

I want to extract the VMMSNEWPALM2SER , Process(TIDC.Imports) and % Privileged Time

My rex is \\\\(?P<vm_h>\w+) , \w+\\\\(?P<v_fields>.*)\\\\ and ^[^\)\n]*\)\\(?P<vm_f>.*?),
alt text

But now, I can't use the v_fields to find the data, though I'm sure I've extracted it.
alt text

And, I can find the v_fields in the left fields sidebar.

why?

What should I do?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi WXY,
try the following regex

index=v_index
| rex "\\\\(?<vm_h>[^\\]*)\\(?<v_fields>[^\\]*)\\(?<field_3>[^,]*)"
| table _time vm_h v_fields field_3

You can test it at https://regex101.com/r/xJredr/1

Bye.
Giuseppe

View solution in original post

DEAD_BEEF
Builder

It may not be in the left sidebar is there is not enough event coverage for it to populate there. Just something to keep in mind. Also I recommend switching to @cusello regex instead of yours.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi WXY,
try the following regex

index=v_index
| rex "\\\\(?<vm_h>[^\\]*)\\(?<v_fields>[^\\]*)\\(?<field_3>[^,]*)"
| table _time vm_h v_fields field_3

You can test it at https://regex101.com/r/xJredr/1

Bye.
Giuseppe

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...