I'm new to the Splunk Search and trying to learn it. I am not from Scripting BG so need help here. I have extraction configured for specific searches/reports now when i want to use the same in another report it 1) that Field extraction is not in the list 2) It is listed as a different name and I want it to be listed with a different name when another report sent for exmple:
INT - extracts the Interfaces and I write a query like - index=ABC
"duplex"| top hostname INT - where log is:
2013-06-14T07:40:10+00:00 10.51.88.34 Jun 14 09:40:09.253 CEST: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet0/2 (not half duplex), with ABCD FastEthernet2/0 (half duplex)
now I would want to use same INT Extractor listed in a different report with the name as INTERFACE - Is it possible?