Field Extractor: Save step
In the Save step of the field extractor you define the name of the new field extraction, set its permissions, and save the extraction.
1. (Optional) Change the Name of the field extraction if you do not accept the default name given by the field extractor.
- The field extractor provides a default name for the field extraction made up of the field names that the field extraction extracts. You can keep this name if you want.
2. (Optional) Change the Permissions of the field extraction to either App or All apps and update the role-based read/write permissions.
- The field extraction is set to Owner, meaning that it only extracts fields in searches run by the person who created the extraction.
- Set Permissions to App to make this extraction available only to users of the app that the field extraction belongs to.
- Set Permissions to All apps to enable all users of all apps to benefit from this field extraction when they run searches.
- When you change the app permissions to App or All apps you can set read and write permissions per role. See "Manage knowledge object permissions," in this manual.
3. Click Finish to save the extraction.
You can manage the field extractions that you create. They are listed on the Field Extractions page in Settings. See "Use the Field Extractions page in Splunk Web," in this manual.
Field Extractor: Validate Fields step
Use the Field extractions page
This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15