How to increaser raw log view limitation when using field extraction via the UI?

[DanAlexander]

Hello network,

I need help understanding how to increase the number of lines within the UI Field Extraction

For example, I have an event containing 38 lines and when sampling for applying regex while field extracting, it gives me visibility of 20 lines only, which prevents me of seen what I actually want to extract as a field.

I did check the ui-prefs.conf but not entirely sure if this is the right place to expand and maximize the window/workflow so I can see all lines and work with these.

SPLUNK.jpg

Thank you  

[isoutamo]

Hi

this is not exactly what you are asking, but I prefer to use https://regex101.com for creating field extractions. Another what you maybe could use is erex command?

r. Ismo

[DanAlexander]

Hi,

Thanks for the reply @isoutamo 

We are using these but wanted to see if I can change the limitations within the UI

regards,

Dan