![]() ![]() ![]() To better understand how the Field extractions page displays your field extraction, it helps to understand how field extractions are set up in your nf and nf files.įield extractions can be set up entirely in nf, in which case they are identified on the Field extractions page as inline field extractions. Review search-time field extractions in Splunk Web Navigate to the Field extractions page by selecting Settings > Fields > Field extractions. For more information about index-time field extraction configuration, see " Configure index-time field extractions" in the Getting Data In Manual. We do not recommend that you change your set of index-time field extractions, but if you need to, you have to modify your nf and nf configuration files manually. Note: You cannot manage index-time field extractions in Splunk Web. Add or delete named extractions that have been defined in nf or the Field transactions page in Splunk Web, if it uses transactions.Update its regular expression, if it is an inline field extraction.If you have additional write permissions for a particular search-time field extraction, the Field extractions page also enables you to: For more information about deleting knowledge objects, see Disable or delete knowledge objects. Default knowledge objects cannot be deleted. Delete field extractions, if your app-level permissions enable you to do so, and if they are not default extractions that were delivered with the product.Field extractions created through the field extractor and the Field extractions page are initially only available to their creators until they are shared with others. Change permissions for field extractions.Create new search-time field extractions.Review the overall set of search-time extractions that you have created or which your permissions enable you to see, for all Apps in your Splunk deployment.The Field extractions page enables you to: Add new field extractions with the Field extractions page.You need Splunk Enterprise to use this method. This method is relatively easy and does not require you to understand how regular expressions work. Use the field extractor to create extractions.There are three methods by which you can add search-time field extractions. Use the Field extractions page in Settings to manage search-time field extractions. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |