Knowledge Management

How do I include samples that did not highlight my extracted field?

wuming79
Path Finder

Hi,

I'm trying to extract a field call Priority and I have highlighted a sample of it. Upon validate, I realized there are some rows that did not hightlight "Priority: 3" and these rows has a red cross on the left (see picture below). I'm not sure what it means. Can someone please help to explain? i can't find examples from documentation on this.

alt text

Tags (1)
0 Karma

wuming79
Path Finder

Hi somsoni2,

Today I search my snort stream, I can find new formats. Priority 3 has 2 different events and there are also priority 0 and 2 but I could not find priority 1. If priority 1 is currently not available, can we still extract it as priority in advance?

Below is my regex for priority: 0
^(?:[^]\n]*]){3}\s+[(?P\w+:\s+\d+)

Here's a screenshot of how it looks when I add sample to extraction.
alt text
alt text

0 Karma

somesoni2
SplunkTrust
SplunkTrust

It means that the regular expression which the IFX came up with didn't match for those two events. If you see closes, you can see those two events have additional text after ICMP PING on line 1 (*NIX), which may be causing Splunk regex to fail. Your best option would be to update the regular expression manually (click on "Show regular expression" and then edit regular expression). If you can paste what regex you see there (do remember to format it using Ctrl+K or cliking on 101010 button), we can help fixing that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...