Field Extractor

[Hegemon76]

Hello,

The field extractor stops at line 20. If what I am looking for is on a line after that what can I do to pull that information?

I have looked for other threads to no avail. If one exists please by all means point me in that direction.

Thanks

[Hegemon76]

Ya I realize the parsing could/should be better but unfortunately I don't have that type of administrative control.

Capping it at 20 lines makes no sense at all.

[logankinman99]

I came across an app yesterday that someone made for download at Splunkbase that allows the field extractor to be more customizable. However, it is not made by Splunk, so I wouldn't download it myself. Let me know if you find a solution

[logankinman99 · Accepted solution]

So it turns out I was wrong, before, so I deleted my previous response. I don't know what was going on before but now I am also in your same position. I looked it up further and it turns out lots of people are having this issue, as well. For some reason, it is capped at 20, and there doesn't seem to be a way around it without extracting it manually, in the search. I'll let you know if I actually find something.