why field extraction doesn't work when defined as calculated field?

[danielbb]

I have this regex -
^(?:[^ \\n]* ){7}(?P<src_host>[^ ]+)[^:\\n]*:\\s+(?P<event_id>[a-f0-9]+:\\d+)(?:[^/\\n]*/){2}(?P<dest_zone>[^\\.]+)

I put it in the field extraction with the right sourcetype as inline field extraction, and it still won't show the extracted fields when searched. 

_internal shows that its status is - "applied"

Any idea why?

[livehybrid]

Hi @danielbb 

Try removing the "P" from each extraction - Splunk uses PCRE (Perl Compatible Regular Expressions) Regex not RE2 so does not include the P in the named extraction.

I also noticed that you mentioned "calculated" field extraction - this expects something can be eval'd not a regex. What you need to use is a "Field Extractions" if editing in the UI, and then add the regex in the "Extraction/Transform" field.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing