Knowledge Management

How to increaser raw log view limitation when using field extraction via the UI?

DanAlexander
Communicator

Hello network,

I need help understanding how to increase the number of lines within the UI Field Extraction

For example, I have an event containing 38 lines and when sampling for applying regex while field extracting, it gives me visibility of 20 lines only, which prevents me of seen what I actually want to extract as a field.

I did check the ui-prefs.conf but not entirely sure if this is the right place to expand and maximize the window/workflow so I can see all lines and work with these.

SPLUNK.jpg

Thank you  

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

this is not exactly what you are asking, but I prefer to use https://regex101.com for creating field extractions. Another what you maybe could use is erex command?

r. Ismo

0 Karma

DanAlexander
Communicator

Hi,

Thanks for the reply @isoutamo 

We are using these but wanted to see if I can change the limitations within the UI

regards,

Dan

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...