Searching using Field Extraction Rules

Comments

3 comments

  • Avatar
    Latimer Luis

    Would you mind sharing the parsing operators being used by your Field Extraction Rule? It would be helpful to have this for additional context. 

    Based on your symptoms, it doesn't seem like your field extraction rule is populating the field correctly. One way to check if the field exists with content is to run a generic _sourceCategory=myCategory search. Once results return, check the field browser on the left hand side to see if the RequestHost is either displayed or hidden. If it exists, hover over the name of the field and check if any non-null values are being populated.

    0
    Comment actions Permalink
  • Avatar
    Zachary Marquez

    None of the fields from my Field Extraction Rule show up when I run a generic search. When I click 'search' to test the FER, I see all of the fields I expect.

    I have specified the following FER for parsing CloudFlare logs:

    json field=_raw "RayID", "ClientCountry", "ClientDeviceType", "ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "ClientSSLCipher", "ClientSSLProtocol", "EdgeResponseStatus", "EdgeResponseBytes", "EdgeStartTimestamp", "EdgeEndTimestamp" as RayID, ClientCountry, ClientDeviceType, ClientIP, RequestHost, RequestMethod, RequestURI, ClientSSLCipher, ClientSSLProtocol, strResponseCode, strResponseLength, strStartTimestamp, strEndTimestamp nodrop | long(strResponseLength) as ResponseBytes | long(strStartTimestamp) as StartTime | long(strEndTimestamp) as EndTime | int(strResponseCode) as ResponseStatusCode | (EndTime - StartTime) / 1000000000.0 as Duration | fields - strResponseLength, strStartTimestamp, strEndTimestamp, strResponseCode | fields - EndTime, StartTime

    0
    Comment actions Permalink
  • Avatar
    Latimer Luis

    I think it would be better tackling as a support case instead of dragging the conversation out here in the community. If you can file a case from the UI with the same info you had above, someone on the Sumo end will take a look into your account. We'll then come back and explain what had occurred for others following this post.  

    1
    Comment actions Permalink

Please sign in to leave a comment.