Splunk Search

Field Extraction and Search Not Syncing Properly

mhomolka
New Member

I am having a problem where I can extract a field, but when using that field in the search it will not return results. I believe I have narrowed the problem down to being an issue with me removing part of the word that is unneeded (it is the same on each field).

Here is an example:

^.*Test(?<extracted>[^:]).*$

TestOne returns 'One', TestTwo returns 'Two', etc.

But when I search using extracted it will fail unless I do one of the following (which both I would prefer to avoid):

Change the regex:

^.*(?<extracted>Test[^:]).*$

TestOne returns 'TestOne', TestTwo returns 'TestTwo', etc.

Add a wildcard at the front of the search: extracted="*One" to get all 'TestOne'

0 Karma
1 Solution

Ayn
Legend

You're probably seeing the effects of what is described here: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Basically Splunk breaks down event data into individual segments and uses those for searching. When you define extractions that do not correspond to any segment Splunk won't find anything.

View solution in original post

0 Karma

Ayn
Legend

You're probably seeing the effects of what is described here: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Basically Splunk breaks down event data into individual segments and uses those for searching. When you define extractions that do not correspond to any segment Splunk won't find anything.

0 Karma

mhomolka
New Member

I was incorrect. I had changed the regex temporarily so that the reports would work correctly and forgot to change them back for the test. Thanks!

0 Karma

mhomolka
New Member

I don't believe this is the answer. In the document it says that I should be able to search using Myfield="*" | search="Valid" and it would work. However, this doesn't work for mine either.

Edit: Just wanted to clarify, this isn't necessarily wrong. I just think there is more to the answer as the test still fails for me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...