Splunk Search

Field Extractions page not showing sample events that match my search

krussell101
Path Finder

I search I specify a host and a source and specific string to search on. I have the results I want to see and now want to extract one or more fields from every event listed.

I click on "exctract fields" and am taken to a new window "Extract Fields".

In the Sample Events window ("This list is based on the event from your search and the field restriction you specified." There are events from other hosts, sources and events that do NOT include the specific string I included in my search.

Clearly this makes extracting the desired data next to impossible.

In the pull down I see that I can select the specific host, but in doing so I have to de-select the specific source. And nowhere do I see any reference to the specific search string.

Am I doing something that can't be done from the Manager?

Tags (1)
0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

You might find the field extractor app on Splunkbase useful. It has much better control over selecting sample events for processing.

View solution in original post

dart
Splunk Employee
Splunk Employee

You might find the field extractor app on Splunkbase useful. It has much better control over selecting sample events for processing.

krussell101
Path Finder

I installed the app. Now I just have to find time to play with it. 😮

Thanks for the suggestion.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...