Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Field Extraction and Search Not Syncing Properly

$
0
0

I am having a problem where I can extract a field, but when using that field in the search it will not return results. I believe I have narrowed the problem down to being an issue with me removing part of the word that is unneeded (it is the same on each field).

Here is an example:

^.*Test(?<extracted>[^:]).*$

TestOne returns 'One', TestTwo returns 'Two', etc.

But when I search using extracted it will fail unless I do one of the following (which both I would prefer to avoid):

Change the regex:

^.*(?<extracted>Test[^:]).*$

TestOne returns 'TestOne', TestTwo returns 'TestTwo', etc.

Add a wildcard at the front of the search: extracted="*One" to get all 'TestOne'


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>