field extractor issues

[a212830]

Hi,

I'm trying to use the field extractor to create some field. When I click on an event, and choose "Extract fields", the search that is presented is not the search that I had run, and therefore, my examples are not present. Is there a way around this?

For example, I run index=network sourcetype=syslog "text". When I choose Extract Fields, the "text" is gone.

[grijhwani]

The field extractor dialogue does not present the results of your search to extract from, it presents the segment of the raw log CONTAINING the transaction you invoked the extractor from. You should at the least find that one instance to work from. I grant it is a nuisance if it is the only instance in the example data shown. In cases like that you have to do the best you can and tweak (or create) the regex for your self (using the testing facility to progress).

I take it you are using the dropdown menu against the log item you require?

And this leads you to a page that looks as follows. There ARE no search paramters, it is just a dump of a raw segment of log, and somewhere in that should be the sample entry whose drop-down you used:

[a212830]

That's just it - it didn't. I picked one of the examples that had the fields that I wanted, but the search that provided those fields wasn't executed.

[kristian_kolb]

yes, that is probably because the interactive field extractor picks a number of events of the same type as the one you selected. Could it be that the "text" you're after only occurs rarely in the events.

You could try making your field extractions with rex and then commit (copy/paste) them to config files directly, without going through the IFX at all.