Hopefully I can explain this one effectively.
I have a search that brings back 3 records. I then select the drop-down field in the leftmost column with an "i" over it. This expands the record and there are more options. There is an "Event Actions" drop-down. I select this and choose "Extract Fields". A new browser tab is opened and I should be able to type in a value in the "Example values for a field" window and click generate and the pattern should be identified in the records. The problem I have is that the Sample Events that are returned are nothing like the 3 records that I was presented with initially. Any insight into what may be happening is welcome.
Not sure at which step you are referring to. At what step in the attached document are you talking about? Thanks for the time on this one.
Well, I don't have enough karma to upload (Thought we would get those with a Splunk license 🙂 Not sure how I can show you... I have to admit the karma thing is a bit cumbersome (to Splunk moderator).