Field Extractions page not showing sample events that match my search

[krussell101]

I search I specify a host and a source and specific string to search on. I have the results I want to see and now want to extract one or more fields from every event listed.

I click on "exctract fields" and am taken to a new window "Extract Fields".

In the Sample Events window ("This list is based on the event from your search and the field restriction you specified." There are events from other hosts, sources and events that do NOT include the specific string I included in my search.

Clearly this makes extracting the desired data next to impossible.

In the pull down I see that I can select the specific host, but in doing so I have to de-select the specific source. And nowhere do I see any reference to the specific search string.

Am I doing something that can't be done from the Manager?

[dart · Accepted solution]

You might find the field extractor app on Splunkbase useful. It has much better control over selecting sample events for processing.

[krussell101]

I installed the app. Now I just have to find time to play with it. 😮

Thanks for the suggestion.