Splunk Search

Windows Event: How to get the complete event show up so it can be extracted?

jcolon68
Explorer

I created a Field Extraction and can see it on the list of Field Extractions. How do I add it to the Fields in a search?

I'm trying to extract a field from Windows Event but for some reason, when trying to extract, the whole message is not coming through. So the part of the message I'm trying to extract doesn't show up.

How can I get the complete message from the Event show up to extract?

0 Karma

Vijeta
Influencer

@jcolon68 Can you be more precise please. If you created a field extraction for a sourcetype (Inline), your search on that sourcetype shall give you the field that you extracted via field extraction.

0 Karma

jcolon68
Explorer

I created the Field Extraction from a search. I apologize , I'm fairly new to splunk not sure what you mean by creating it for a sourcetype (Inline).
I created the Field, re ran the same search ., but I don't see the new field in available fields.

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...