Splunk® Enterprise

User Manual

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Extract fields interactively in Splunk Web

Use the interactive field extraction (IFX) feature of Splunk Web to create custom fields dynamically on your local Splunk instance. IFX enables you to define any pattern for recognizing one or more fields. IFX is especially useful if you are not familiar with regular expression syntax and usage, because it will generate field extraction regexes for you (and enable you to test them). Also, unless you hand edit the regular expression, IFX learns to extract only one field at a time.

Splunk is very good at handling Web access logs, so there is really no information that it hasn't already extracted for you. For the examples here, let's just walk how to extract the IP addresses from events.

1. To access the IFX, first run a search that generates events containing the field values that you want to extract.

Because we're interested in extracting IP addresses, we can search for Apache access logs with:


2. From the results of the search, find an event that contains the field value; in this case, an IP address. Click on the arrow to the left of the timestamp of an event and select Extract fields.

Select extract fields.png

The IFX opens in a new window, Extract fields.

IFX Extract fields window.png

3. Choose sourcetype="access_combined" from the Restrict field extraction to menu.

Restrict field extraction.png

This dropdown is populated with the field values from the event that you selected in step 2. If you want to choose a different host, source, or sourcetype value, close the window and select a different event in your search results or run a new search.

4. Type, or copy and paste, some values of IP addresses from your results into the Example values text box. For best results, give multiple examples.

Ifx example values.png

The list of Sample events is based on the event you selected from your search results and the field restriction you specified. If you change the field restriction, this list also changes; but it will still be based on the original event you selected.

5. When you think you have enough sample values, click Generate. Splunk generates a regex pattern for your field, based on the information you gave it and the general format of your events.

Ifx sample events.png

6. Review the Sample extractions and Sample events to see if there are any values that you don't want or any values that you do what that aren't displayed in the list.

If you see unwanted values, click the X next to the value to remove it. If you notice a value that is left out, add it to the list of Sample events. The IFX will update the generated pattern to reflect this change. To re-add any value and reset the regex, just click the + icon next to it.

7. Before you save the new field, you can test the regex against a larger data set or edit the pattern manually.

When you click Test from the field extractions page, Splunk takes you to the Search view and runs a search:

  • against your host, source, or sourcetype restriction, limited to first 10,000 results.
  • using the rex command with the regex Splunk generated for your FIELDNAME, removing any duplicate occurrences of the field value.

If you edit the search expression manually in the test window, you must copy-paste your changes back to the IFX page.

If you're familiar with writing regexes, you can edit the pattern manually after Splunk generates it; just click Edit in the IFX window.

Also, you'll notice that the name of the extracted field in the search or edit window is "FIELDNAME". You do not need to rename this value because it will be set with the name you enter when you save the extraction.

After testing or editing your regex, return to the IFX window.

8. If the expression looks like it's working, click Save.

This opens the Save Field Extraction window.

9. Name your extraction clientip and click Save.

Save clientip field extraction.png

Splunk only accepts field names that contain alpha-numeric characters or an underscore:

  • Valid characters for field names are a-z, A-Z, 0-9, or _ .
  • Field names cannot begin with 0-9 or _ . (Leading underscores are reserved for Splunk's internal variables).

Important: Extractions created by a user will be located in $SPLUNK_HOME/etc/users and will be a function of the role a user has, with relationship to the app.

Extract fields with search commands
Use field lookups to add information to your events

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7


Why does it only show about 15 lines and nothing more?

July 20, 2012

I am trying to extract the value of a log file query string field "elapsed=nnn" and I'd like the "nnn" to be a numerical value I can sort. How would I do that?

Splunk demystified
June 3, 2012

I have a FTP log with , say 06Dec11. I can easily "extract" this field - it works great, but how do I tell Splunk that this is a date with DDMMYY

Esi splunk
December 7, 2011

When I click to TEST, the warning window appears allowing CANCEL or TEST. I click TEST again, the warning window disappears but a new search window does not appear. I am currently running Splunk 4.1.6 with SSL enabled (and no valid certificate). Are there any known issues running the IFX with SSL enabled?

March 16, 2011

hi Anton,<br />i recommend that you ask this question over at answers.splunk.com. thanks!

December 14, 2010

Why can't I extract fields from a previously built eventtype? I can limit to sourcetype (as shown above), but I'd really like to first built an eventtype and then "parse" it?<br /><br />Any ways to do it?

Anton chuvakin
December 14, 2010

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters