×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
gersplunk
Engager
Member since: ‎03-01-2025
‎03-07-2025
Community Statistics
Posts 3
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎03-01-2025
Activity Feed
Topics I've Started
View All

Re: missing extraction fields

by in Splunk Search
‎03-04-2025 01:24 AM
‎03-04-2025 01:24 AM
Nice trick @livehybrid , but no luck. Here's the field extraction for dest_ip You can see the preview says '1000 events'... and there's a "dest_ip" at bottom left. then >Save, >Finish >Explore the fields I just created in Search: it has changed time range to last 24h, showing no Results; then I change to All Time and get the usual result: no sign of my extraction field on the left, in the 105 more fields or in All fields, etc.     ... View more

Re: missing extraction fields

by in Splunk Search
‎03-01-2025 10:33 PM
‎03-01-2025 10:33 PM
Thanks for the reply, @yuanliu. Sadly I don't know whether it's actually json; it might be. It's a college assignment, and we just know it's a bunch of data/logs in tar.gz. "src_ip" and the other one have never appeared automatically in interesting fields so far. Would you expect them to appear as their "natural names" if it was json or would I need to do something proactive? Either way, why doesn't the extracted field appear? ... View more

missing extraction fields

by in Splunk Search
‎03-01-2025 03:57 PM
‎03-01-2025 03:57 PM
I've created field extractions in splunkcloud.com, but they don't appear. Here are my extractions: settings>fields>field extractions:  App: searching & reporting, config source: visible in app, Owner: sc_admin journal : EXTRACT-destip Inline "dest_ip\":\"(?P<destip>[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)\”" sc_admin search Global | Permissions Enabled object should appear: all apps permissions: apps r/w, sc_admin r/w   journal : EXTRACT-srcip Inline "src_ip\":\"(?P<srcip>[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)\”" sc_admin search App | Permissions Enabled object should appear: this app only (search) permissions: sc_admin r/w   After Add data from a tar.gz file upload, splunkcloud (login as sc_admin)>search>interesting fields: all fields:all fields doesn't include those fields. What am I missing? Btw, if I extract new fields with the same names it objects because they already exist. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎03-07-2025 02:27 AM
Karma given to
View All