Interactive field extractor sample data

[khodges_splunk]

Is there a way to control the sample data displayed in the IFX sample data? It is not selective enough for me to see values that I want to extract. So, I have to return to the search window first to find the data values I want.

[Drainy]

Not that I know of but someone else might jump in and say otherwise. Sadly while the IFX is great for quick and dirty ways to perform field extractions it doesn't quite match the capabilities of creating your own extractions.

So, if you did want to create your own you essentially need to learn a little bit of regex which is easier than it sounds and then learn how to modify the transforms.conf and props.conf. Inside transforms you define regex extractions which splunk uses to look for fields within events and the names for those fields. In props you apply those transforms and you can be specific in applying these against particular sourcetypes, sources etc.

If you did want any help with specific regex's then feel free to reply back with more details. Oh and this site here is good for helping to learn and test regex's

[whateverman]

yes, this is an issue I am having as well. Would be nice to have more control on the sample data.

[rps462]

It would be great if the IFX sample data that's shown could be based off the current search.

[Drainy]

No, but the sample data it extracts should usually be suitable. I guess you just have a large range of varied results? You could always do more specific searches and assign the same fieldnames to fields that the IFX won't match but are meant to be the same

[khodges_splunk]

Thanks for your response. Yes, using transforms and props, or even the rex command provide a great level of flexibility. But I was wondering if anyone knew a trick to be able to modify that sample data seen in IFX; for the reason you stated here.