If its during search time, you can either use the mode=sed with a regular expression For e.g. | rex mode=sed "s///g" OR I would use sedcmd in props.conf SEDCMD-change_field = s///g ... View more

Splunk auto extracts fields when fields=value criteria is met. Since the event has "msg=Network: " it auto extracts the msg field as Network To overcome this I would use a regular expression with named capturing groups to extract specific fields as per the requirement For e.g: to Capture the message using a named capturing group i would use this. Having said that using .* is not always the best method as it captures everything else after the msg actually ends. The field named as Message will capture the messages. LMK if this works (?i)msg=(?P<Message>.*) ... View more

Yes! It is Here is a Sample <input type="dropdown" token="eventtype" searchWhenChanged="false"> <label>Select an Event Type to proceed</label> <choice value="*">All</choice> <populatingSearch fieldForLabel="eventtype" fieldForValue="eventtype"> <![CDATA[index="xxxxxxxindex" sourcetype=xxxxxx | stats count by eventtype | dedup eventtype | fields eventtype]]> </populatingSearch> <default>*</default> </input> ... View more

Thanks lrudolph!! Had the same issue.. Fixed it 🙂 ... View more