Hi Guys
I am trying to delete some Fields configured by someone else, but I can't find where they are.
First of all, they are Chinese Characters. I want to replace them with Az.
I searched in Splunk Web, "Field extractions" with the sourcetype name or any of the field names, but nothing found. Then I grepped all the *.conf from $SPLUNK_HOME$, but no result returned.
I know they are normally in props.conf or transforms.conf. I checked every one of them, but failed to find anything. However, the FIELDs are there extracted when I do the search!
Where else could they be?
Thank you!
... View more