topic Re: Rename Field created with Interactive Field Extractor in Splunk Search

Rename Field created with Interactive Field Extractor

RVDowning — Thu, 19 Jan 2012 19:09:58 GMT

How does one rename a field created with the Interactive Field Extractor?

Re: Rename Field created with Interactive Field Extractor

ftk — Thu, 19 Jan 2012 19:43:11 GMT

If you used the IFX the extraction is likley inline and should be easy to edit via the UI. Got to Manager > Fields > Field extractions and click on the name of the field extraction you created in the IFX. In the Extract/Transform field hunt down the field name (it will look similar to this: (?P ). Just replace the fieldname with your desired name, and then click Save.

Alternatively, you can edit the appropriate EXTRACT line in the appropriate props.conf configuration file in $SPLUNK_HOME$/etc/apps/yourapp/local/props.conf.

Re: Rename Field created with Interactive Field Extractor

RVDowning — Thu, 19 Jan 2012 20:28:52 GMT

No fields appear in Manager > Fields > Field extractions

The only props.conf that contained the field name in question was in:
/opt/splunk/etc/users/admin/search/local

I had tried renaming the props.conf file thinking that I could then recreate the field spelled correctly, but it seemed to have no effect. I can still find no way to either delete the field so that it can be recreated, or to edit its contents unless I modify the generated regular expression manually.

Re: Rename Field created with Interactive Field Extractor

ftk — Thu, 19 Jan 2012 20:36:31 GMT

In Manager > Fields > Filed extractions make sure you select the correct app context from the drop down at the top (or just select all). You should be able to find it then.

Re: Rename Field created with Interactive Field Extractor

RVDowning — Thu, 19 Jan 2012 20:51:44 GMT

Ah, that was it. Thanks. I hadn't even noticed the app context.

Re: Rename Field created with Interactive Field Extractor

RVDowning — Thu, 19 Jan 2012 21:07:02 GMT

Spoke too soon. I had tried renaming the field in props.conf. After your answer I renamed it back to the original name and then tried to delete the field using Manager > Fields > Field extractions but kept getting an error. So I renamed props.conf to xprops.conf hoping to get rid of it that way. However when I run a search I still see the original field name and my attempted renaming of it in the list of fields.

Re: Rename Field created with Interactive Field Extractor

ftk — Thu, 19 Jan 2012 21:52:32 GMT

What error did you get in the Manager? Did a new props.conf appear after you renamed the original?