Splunk Search

default visibility of extracted field

aniketb
Path Finder

I'm working on a report that uses lot of fields. I would be extracting those fields across many sourcetypes. I have my personal username in splunk. This question just struck me,

"What is the default visibility of extracted fields?"

Is is visible to all other users also? If it is, it's better that I delete the one time use extractions so as not to clutter Splunk.

0 Karma
1 Solution

lguinn2
Legend

By default, your field extractions are private, if you created them using the Manager or the Interactive Field Extractor. You can change that selectively by going to Manager -> Fields.

Still, if they are one-time-use, you might want to delete them.

And perhaps a better alternative in the future is to use the rex command, which creates field extractions on the fly. The fields created by the rex command are not saved.

View solution in original post

lguinn2
Legend

By default, your field extractions are private, if you created them using the Manager or the Interactive Field Extractor. You can change that selectively by going to Manager -> Fields.

Still, if they are one-time-use, you might want to delete them.

And perhaps a better alternative in the future is to use the rex command, which creates field extractions on the fly. The fields created by the rex command are not saved.

aniketb
Path Finder

Thanks a lot! Good description!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...