Parse works, field extraction doesn't

Follow

Brian Devins

• March 20, 2017 14:02

I can successfully parse data with a search query, but putting the same query into a field extraction rule often doesn't show the parsed fields. Here's an example: _sourceCategory=networking/clearpass 1.2.3.4 | parse "Endpoint.Username=*#" as wifi_Username | parse "Endpoint.MAC-Address=*#" as wifi_MACaddress | parse "Endpoint.IP-Address=*#" as wifi_IPaddress When I put this into a search I can see the 3 new entries in the Display Fields list, populated with data. However, I added this exact info into a field extraction and when I just search for the IP address (or the sourceCategory and IP address) the fields don't display. Here's a screenshot of my field extraction rule. Any assistance would be appreciated.

0

• 

  Michael Floyd

  • March 22, 2017 23:33

  Hi Brian, try posting in the Slack channel (link is in the top nav above).

  0

  Comment actions Permalink
• 

  Mario Sanchez

  • May 10, 2017 20:48

  Hey Brian, Your parse rule seems to be created correctly. Here's 2 things I can comment/suggest: -- Parse rules only act on new data being ingested, as the parsing happens at the time of ingestion (unlike parsing in the query which can parse previously ingested data), so if you wait for new data to ingest, you should see those parse fields. -- If not all log messages have wifi_Username, wifi_MACaddress and/or wifi_IPaddress, you should add the nodrop option to your parse statements so that those that do exist in the message do not get dropped. Hope this helps! Cheers, Mario

  0

  Comment actions Permalink

Please sign in to leave a comment.