topic Re: Interactive field extractor in Splunk Search

Interactive field extractor

jangid — Wed, 01 Aug 2012 09:03:05 GMT

my search is based on the eventtype="someevents" and now I want to extract field and I want to restrict my fields extraction based on eventtype.

in IFX [http://mjserver:8000/en-US/ifx?sid=1343810123.69&offset=0&namespace=MyApp] page I can not see eventtype listing in Restrict extraction to: combo box.

How do I add eventtype in that combo box

Re: Interactive field extractor

jangid — Fri, 10 Aug 2012 10:02:38 GMT

Any update?

Re: Interactive field extractor

jangid — Mon, 13 Aug 2012 09:31:29 GMT

Is it possible to change IFX restriction?if Yes how do I?

Re: Interactive field extractor

dwaddle — Tue, 14 Aug 2012 15:32:25 GMT

This is not possible in the current release (4.3). It is not a limitation of the interactive extractor, but of Splunk itself. Field extractions can only be defined for a sourcetype, source, or host. You cannot today define an extraction scope to an eventtype.

There is little additional processing cost (if any) for doing extraction based on the sourcetype(s) in question.

You can, of course, feel free to submit an enhancement request, see http://splunk-base.splunk.com/answers/4844/how-can-i-submit-an-enhancement-request

Re: Interactive field extractor

jangid — Tue, 14 Aug 2012 16:13:43 GMT

Thanks dwaddle.