Getting Data In

Field extraction only works partial

mikeschneider
Explorer

Hello Splunkers,

I created a (index-time) field extraction with the following regex:

REGEX = ^\d+;\d{11}02(\d{5})\d{5}

This extracts a Number from a CSV-File and stores it in a field "fkennung". I see that the field is filled at index time
and its also in the fields list in splunk UI, filled with correct values. Lets say one of the numbers in that field is 51117.
If i do a wildcard search "fkennung=51*" the search returns the correct events, all numbers in "fkennung" starting with 51.
If id do a wildcard search "fkennung=511*" or a search with the vale "fkennung=51117" splunk doesnt return any results.
Even if i klick on a value at the field menu,the search doesnt return any results.

Any ideas ?

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

In addition to defining the props/transforms extraction, did you defined the field in fields.conf ?

see http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-timefieldextraction

Try to add the following lines to fields.conf:
[fkennung]
INDEXED=true

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

In addition to defining the props/transforms extraction, did you defined the field in fields.conf ?

see http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-timefieldextraction

Try to add the following lines to fields.conf:
[fkennung]
INDEXED=true

0 Karma

mikeschneider
Explorer

....it works....just a typo in fields.conf,thank you Yann 🐵

0 Karma

mikeschneider
Explorer

btw, Hi Yann,i guess we met in London 🐵

yannK
Splunk Employee
Splunk Employee

indeed. Happy it worked 🙂

0 Karma

mikeschneider
Explorer

Yep,did that already 🐵

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...