I'm still quite new to Splunk so my wording may be a little off. I am running into an issue when trying to create a field extraction for a GUID. My logs are consistent in that the GUID is always proceeded with "z8UserGUID: " and the end of the line is a whitespace. The GUID can be literally NULL and also changes in length/size but always delaminated with – hyphen. So I've just created a regex to capture the line instead of being specific to the character.
Expression: /bz8UserGuid:/s+/K/S+ ( I had to switch the backslash to a forward slash to make this post)
Test String: z8UserGuid: 5PZ3PL8W-2ZD-D1LW4VZ0FD-WZ1MV2LT2MLW4VZ
My issue is I can't seem to get the field to populate into the fields section of the search screen.
I will eventually need to figure out how to create advanced search strings and how to utilize this new knowledge into creating dashboards.
I’ve tried to add it in at the source type configuration area, the add_new_field area and the Interactive Field Extractor (IFE) but it’s still not popping up in the field list. Additionally I’ve also tried to add a capture group and non_capture group tag into the expression to no avail.
So I’m thinking I need to do something more or different …. Any ideas?
↧