topic How to increaser raw log view limitation when using field extraction via the UI? in Knowledge Management

How to increaser raw log view limitation when using field extraction via the UI?

DanAlexander — Tue, 06 Jun 2023 13:34:32 GMT

Hello network,

I need help understanding how to increase the number of lines within the UI Field Extraction

For example, I have an event containing 38 lines and when sampling for applying regex while field extracting, it gives me visibility of 20 lines only, which prevents me of seen what I actually want to extract as a field.

I did check the ui-prefs.conf but not entirely sure if this is the right place to expand and maximize the window/workflow so I can see all lines and work with these.

Thank you

Re: Raw log view limitation when using Field Extraction via the UI

isoutamo — Tue, 06 Jun 2023 08:45:05 GMT

this is not exactly what you are asking, but I prefer to use https://regex101.com for creating field extractions. Another what you maybe could use is erex command?

r. Ismo

Re: Raw log view limitation when using Field Extraction via the UI

DanAlexander — Tue, 06 Jun 2023 08:59:52 GMT

Hi,

Thanks for the reply @isoutamo

We are using these but wanted to see if I can change the limitations within the UI

regards,

Dan