Splunk Search

searchmanager : Error extracting fields

edrivera3
Builder

Hi
Today I started to work with the Django binding and I am trying to extract a field, but I encountered an error. I am not sure what is wrong. I tried to run the search inline and it worked correctly.

{% searchmanager
id="stats_count_by_cart_num"
search="index=jobevent NOT "Racu name" | rex "For\sCartNumber\s(?<cart_num>\w{2}\d{3})" | stats count by cart_num"
earliest_time="-2y@y"
latest_time="now"
cache=False
%}

⚠ Error in 'rex' command: The regex '"For\sCartNumber\s(?<cart_num>\w{2}\d{3})"' does not extract anything. It should specify at least one named group. Format: (?...).

0 Karma
1 Solution

stephanefotso
Motivator

I think the problem should be your regular expression. Try this:

search="index=jobevent NOT \"Racu name\" | rex field=_raw  \"ForsCartNumbers(?<cart_num>w{2}d{3})\" | stats count by cart_num"
SGF

View solution in original post

0 Karma

stephanefotso
Motivator

I think the problem should be your regular expression. Try this:

search="index=jobevent NOT \"Racu name\" | rex field=_raw  \"ForsCartNumbers(?<cart_num>w{2}d{3})\" | stats count by cart_num"
SGF
0 Karma

edrivera3
Builder

Now, I am extracting the field using props.conf. I verified it in the Splunk App and the field values are correct so there is no problem with the regex. But for some reason there is not result found from the search. I think maybe the problem is related to some permission limitation but I am not sure where to look for them.

0 Karma

stephanefotso
Motivator

I'm not sure about some permission here. I think you must escape double quotes properly. In some cases, instead of enclose your search wth double quotes you must use simple quotes. Something like this

 search='index=jobevent NOT \"Racu name\" | rex field=_raw  \"ForsCartNumbers(?&lt;cart_num&gt;w{2}d{3})\" | stats count by cart_num'
SGF
0 Karma

edrivera3
Builder

Thank you. You were right. I made the changes and it worked perfectly.

0 Karma

edrivera3
Builder

UPDATE: ;
I decided to extract the field in props.conf, but I encountered an error anyway: No results found.

search="index=jobevent NOT "Racu name" | stats count by cart_num"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...