Splunk Search
Highlighted

Is there a way to customize delimiter based field extractions via the UI?

Splunk Employee
Splunk Employee

Is there a way to customize delimiter based field extractions via the UI? Looks like you can do it for regular expression but not for delimiter based field extractions.

0 Karma
Highlighted

Re: Is there a way to customize delimiter based field extractions via the UI?

Splunk Employee
Splunk Employee

If you create a delimiter based field extraction Splunk will create two objects. One in the “Field Extractions” menu, this is where all regular extractions are displayed as well.
In order to modify a delimiter based field extraction, you have to go to the “Field transformations” menu (screenshot attached) in order to do modifications.

Credit @Kai-Ping Seidenschnur and @Rene Siekermann

View solution in original post

0 Karma