Splunk Search

Windows Event: How to get the complete event show up so it can be extracted?


I created a Field Extraction and can see it on the list of Field Extractions. How do I add it to the Fields in a search?

I'm trying to extract a field from Windows Event but for some reason, when trying to extract, the whole message is not coming through. So the part of the message I'm trying to extract doesn't show up.

How can I get the complete message from the Event show up to extract?

0 Karma


@jcolon68 Can you be more precise please. If you created a field extraction for a sourcetype (Inline), your search on that sourcetype shall give you the field that you extracted via field extraction.

0 Karma


I created the Field Extraction from a search. I apologize , I'm fairly new to splunk not sure what you mean by creating it for a sourcetype (Inline).
I created the Field, re ran the same search ., but I don't see the new field in available fields.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...