Hi .
I have written the following regex in my query , then it is working fine but when i am trying to create this regex expression in the field extractor it is not coming in the query.
My regex expression ::
(?
Query Used after creating field extractor ::
Sourcetype="mydata" | top Test
but this is not workin ..Please help ..
First, the names of fields are case-sensitive. You created a field named "test" but then your top command used a field called "Test". That's never going to work.
Second, although your regular expression may be legal, I would have written it:
(?im)(?<test>"(?:Request|Response)")
I have noticed that Splunk is sometimes finicky about non-capturing parenthesis; this regular expression is a bit clearer. And are the quotation marks actually in the data? Do you really need them for the regular expression?
First, the names of fields are case-sensitive. You created a field named "test" but then your top command used a field called "Test". That's never going to work.
Second, although your regular expression may be legal, I would have written it:
(?im)(?<test>"(?:Request|Response)")
I have noticed that Splunk is sometimes finicky about non-capturing parenthesis; this regular expression is a bit clearer. And are the quotation marks actually in the data? Do you really need them for the regular expression?
No quotation marks are not need lginn .. thnx for the regular expression .this worked for me..:)