Splunk Search

field extractor issues

a212830
Champion

Hi,

I'm trying to use the field extractor to create some field. When I click on an event, and choose "Extract fields", the search that is presented is not the search that I had run, and therefore, my examples are not present. Is there a way around this?

For example, I run index=network sourcetype=syslog "text". When I choose Extract Fields, the "text" is gone.

Tags (1)
0 Karma

grijhwani
Motivator

The field extractor dialogue does not present the results of your search to extract from, it presents the segment of the raw log CONTAINING the transaction you invoked the extractor from. You should at the least find that one instance to work from. I grant it is a nuisance if it is the only instance in the example data shown. In cases like that you have to do the best you can and tweak (or create) the regex for your self (using the testing facility to progress).

I take it you are using the dropdown menu against the log item you require?

alt text

And this leads you to a page that looks as follows. There ARE no search paramters, it is just a dump of a raw segment of log, and somewhere in that should be the sample entry whose drop-down you used:

alt text

a212830
Champion

That's just it - it didn't. I picked one of the examples that had the fields that I wanted, but the search that provided those fields wasn't executed.

0 Karma

kristian_kolb
Ultra Champion

yes, that is probably because the interactive field extractor picks a number of events of the same type as the one you selected. Could it be that the "text" you're after only occurs rarely in the events.

You could try making your field extractions with rex and then commit (copy/paste) them to config files directly, without going through the IFX at all.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...