topic Re: Getting a list of field extractions using the API in Getting Data In

Getting a list of field extractions using the API

joemaz95 — Mon, 08 Jul 2019 15:11:20 GMT

There are 2 endpoints that seem to return extractions which are data/transforms/extractions and data/props/extractions. I've created some extractions that don't appear in the list when I hit these endpoints. I can only get an extraction in the list by setting the "Apply to" field to host from the dropdown in the UI. Does anyone have any insight as to why the extraction has to be applied to a host for it to show up in endpoint output?

Re: Getting a list of field extractions using the API

jawaharas — Wed, 10 Jul 2019 07:51:49 GMT

May I know in which screen you see 'Apply to' option?

" I can only get an extraction in the list by setting the "Apply to" field to host from the dropdown in the UI"

Re: Getting a list of field extractions using the API

joemaz95 — Wed, 10 Jul 2019 13:36:14 GMT

Thanks for helping me clarify. The field in question is found here:
Settings Dropdown > Fields > Field Extractions > New Field Extraction > Apply to _____ named _____

Re: Getting a list of field extractions using the API

woodcock — Tue, 23 Jul 2019 17:14:22 GMT

Try these (it is probably in a different app that you think):

|rest/servicesNS/-/-/data/transforms/extractions
|rest/servicesNS/-/-/data/props/extractions

Re: Getting a list of field extractions using the API

joemaz95 — Thu, 22 Aug 2019 17:37:09 GMT

Thanks for the response, this didn't appear to resolve the issue.

Re: Getting a list of field extractions using the API

jawaharas — Mon, 26 Aug 2019 05:24:07 GMT

The field extraction entity should be tagged (applied) to sourcetype, host or source. It's required field.

Re: Getting a list of field extractions using the API

joemaz95 — Mon, 26 Aug 2019 16:26:20 GMT

Right! I'm trying to get a list of every field extraction, but only extractions tagged with "host" are returned.

Re: Getting a list of field extractions using the API

jawaharas — Tue, 27 Aug 2019 00:40:09 GMT

It should be there. I tried to search an field extraction which is tagged to a sourcetype and the REST API returns result.

| rest /services/data/props/extractions
| search title="<NAME_OF_YOUR_FIELD_EXTRACTON>"

Re: Getting a list of field extractions using the API

jawaharas — Fri, 30 Aug 2019 07:28:58 GMT

@joemaz95
Kindly accept the answer if it helped you.

Re: Getting a list of field extractions using the API

joemaz95 — Fri, 30 Aug 2019 14:10:11 GMT

Unfortunately, the extractions in question still don't appear when hitting that endpoint.

Re: Getting a list of field extractions using the API

woodcock — Fri, 30 Aug 2019 22:08:52 GMT

How can anybody help you without more detail? The answer that I provided absolutely works unless you do not have privilege/permission to access the endpoint, which is probably the case.