Splunk Search

Someone else configured field extractions, but I would like to delete some of them. Where do I find them?


Hi Guys

I am trying to delete some Fields configured by someone else, but I can't find where they are.
First of all, they are Chinese Characters. I want to replace them with Az.

I searched in Splunk Web, "Field extractions" with the sourcetype name or any of the field names, but nothing found. Then I grepped all the *.conf from $SPLUNK_HOME$, but no result returned.
I know they are normally in props.conf or transforms.conf. I checked every one of them, but failed to find anything. However, the FIELDs are there extracted when I do the search!

Where else could they be?
Thank you!

0 Karma

New Member

I see this is an old post but I was facing the same issue. I found if i went to Settings/Fields/Field Extractions I was able to view all the fields anyone has created. Then I was able to delete what I no longer needed. You may have to be a power user to do this but does not require console access.

0 Karma


If the delete action doesn't appear in UI then you'll have to check the props.conf for each app on the searcher and remove it manually from the file. You may be able to delete field extractions using REST as well.

Splunk Employee
Splunk Employee

they might be under spacific apps so you have to go to $splunkhome/etc/apps/appname

to find out the app holding the information use btool
$splunkhome/bin/splunk btool props list --debug | more
$splunkhome/bin/splunk btool transform list --debug | more

good luck

0 Karma


thank you!
but I still can not find those fields defination.
and this command can only display conf in ../etc/system and ../etc/apps, but not in ../etc/users?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...