Splunk Search

field extraction


I am able to execute the below search command using rex and retrieve the output successfully

index=xyz | rex field=_raw "queue[\s=]'(?.*)'([\s:]|$)" | search q1='test.queue'

however when i am creating a filed extraction using regex for the above "q1" field i am unable to retrieve any results.(index=xyz | q1='test.queue'
regex used in field extraction page is queue[\s=]'(?.*)'([\s:]|$)

can anyone help me in letting me know how to create the field extraction from a rex command

Tags (1)


Tried using the "where" command?


so use it something like ... index=xyz | rex field=_raw "queue[s=]'(?.*)'([s:]|$)" | where like(q1, "test.queue")

0 Karma


2012-01-03 16:42:17.346 [MSG:234123] acknowledged by user='admin': queue='test.queue'
2012-01-03 16:42:17.334 : Destroyed producer (connid=10, sessid=9, prodid=4) into queue 'test.queue'

in both the cases im trying to extract queue field

0 Karma

Splunk Employee
Splunk Employee

It would help if you could post a sample of your data.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!