Splunk Search

Why is the field I have extracted not shown and not available for search?

WXY
Path Finder

I extracted three fields.

The data is \\VMMSNEWPALM2SER\Process(TIDC.Imports)\% Privileged Time, ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0

I want to extract the VMMSNEWPALM2SER , Process(TIDC.Imports) and % Privileged Time

My rex is \\\\(?P<vm_h>\w+) , \w+\\\\(?P<v_fields>.*)\\\\ and ^[^\)\n]*\)\\(?P<vm_f>.*?),
alt text

But now, I can't use the v_fields to find the data, though I'm sure I've extracted it.
alt text

And, I can find the v_fields in the left fields sidebar.

why?

What should I do?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi WXY,
try the following regex

index=v_index
| rex "\\\\(?<vm_h>[^\\]*)\\(?<v_fields>[^\\]*)\\(?<field_3>[^,]*)"
| table _time vm_h v_fields field_3

You can test it at https://regex101.com/r/xJredr/1

Bye.
Giuseppe

View solution in original post

DEAD_BEEF
Builder

It may not be in the left sidebar is there is not enough event coverage for it to populate there. Just something to keep in mind. Also I recommend switching to @cusello regex instead of yours.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi WXY,
try the following regex

index=v_index
| rex "\\\\(?<vm_h>[^\\]*)\\(?<v_fields>[^\\]*)\\(?<field_3>[^,]*)"
| table _time vm_h v_fields field_3

You can test it at https://regex101.com/r/xJredr/1

Bye.
Giuseppe

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...