I setup a field extraction two ways, neither have worked and have caused Splunk to not function in a manner I think it should.
I setup a field extraction through the GUI and applied a transform through the GUI. Upon searching, the extraction is not shown, which would point me in the direction of my regex being incorrect, however, I do not believe this to be the case. The weird part is when I attempt to do a field extraction through the Wizard walk through, it takes me to a blank page now, and if I remove it the page now loads.
Since this did not work, I attempted to create the files manually in the app to see if the GUI was breaking it, but I got the same results as above. below is a copy of my props and transforms config files.
Props.conf:
[sr_info]
EXTRACT-id = id
Transforms.conf
[id]
MV_ADD = 1
REGEX = (?<id>(EI|EP|DK)\d{15})
Any ideas why this would be breaking the Wizard Walk through extraction page, the one you are able to click on via the event(s)?
FYI - When I do the extraction through the Wizard my regex is fine, it is rather simple anyways and wouldn't expect any issues from it.
↧