topic Someone else configured field extractions, but I would like to delete some of them. Where do I find them? in Splunk Search

Someone else configured field extractions, but I would like to delete some of them. Where do I find them?

crazyeva — Tue, 17 May 2016 02:20:44 GMT

Hi Guys

I am trying to delete some Fields configured by someone else, but I can't find where they are.
First of all, they are Chinese Characters. I want to replace them with Az.

I searched in Splunk Web, "Field extractions" with the sourcetype name or any of the field names, but nothing found. Then I grepped all the *.conf from $SPLUNK_HOME$, but no result returned.
I know they are normally in props.conf or transforms.conf. I checked every one of them, but failed to find anything. However, the FIELDs are there extracted when I do the search!

Where else could they be?
Thank you!

Re: Someone else configured field extractions, but I would like to delete some of them. Where do I find them?

mosman_splunk — Tue, 17 May 2016 02:50:40 GMT

they might be under spacific apps so you have to go to $splunkhome/etc/apps/appname

to find out the app holding the information use btool
$splunkhome/bin/splunk btool props list --debug | more
$splunkhome/bin/splunk btool transform list --debug | more

good luck

Re: Someone else configured field extractions, but I would like to delete some of them. Where do I find them?

crazyeva — Tue, 17 May 2016 07:00:49 GMT

thank you!
but I still can not find those fields defination.
and this command can only display conf in ../etc/system and ../etc/apps, but not in ../etc/users?

Re: Someone else configured field extractions, but I would like to delete some of them. Where do I find them?

the_wolverine — Thu, 11 Aug 2016 19:58:59 GMT

If the delete action doesn't appear in UI then you'll have to check the props.conf for each app on the searcher and remove it manually from the file. You may be able to delete field extractions using REST as well.

Re: Someone else configured field extractions, but I would like to delete some of them. Where do I find them?

muzicman61 — Fri, 28 Dec 2018 20:08:59 GMT

I see this is an old post but I was facing the same issue. I found if i went to Settings/Fields/Field Extractions I was able to view all the fields anyone has created. Then I was able to delete what I no longer needed. You may have to be a power user to do this but does not require console access.