Add an auto-extracted field

You can add an auto-extracted field to any root dataset in your data model.

1. In the Data Model Editor, open the root dataset you'd like to add an auto-extracted field to.
2. Click Add Field and select Auto-extracted to define an auto-extracted field.

   The Add Auto-Extracted Field dialog appears. It includes a list of fields that can be added to your data model datasets.

3. Select the fields you would like to add to your data model by marking their checkboxes.

   You can select the checkbox in the header to select all fields in the list.

   If you look at the list and don't find the fields you are expecting, try changing the event sample size, which is set to the First 1000 events by default. A larger event sample may contain rare fields that didn't turn up in the first thousand events. For example, you could choose a sample size like the First 10,000 events or the Last 7 days.

4. (Optional) Rename the auto-extracted field.

   If you use Rename, do not include asterisk characters in the new field name.

5. (Optional) Correct the auto-extracted field Type.
6. (Optional) Update the auto-extracted field's status (Optional, Required, Hidden, or Hidden and Required) as necessary.
7. Click Save to add the selected fields to your root dataset.

Note: You cannot add auto-extracted fields to child datasets. Child datasets inherit auto-extracted fields from the root dataset at the top of their dataset hierarchy.

The list of fields displayed by the Add Auto-Extracted Field dialog includes:

• Fields that are extracted automatically, like uri or version. This includes fields indexed through structured data inputs, such as fields extracted from the headers of indexed CSV files.
• Field extractions, lookups, or calculated fields that you have defined in Settings or configured in props.conf.

Expand a field row for a field to see its top ten sample values.

Manually add a field to the set of auto-extracted fields

While building a data model you may find that you are missing certain auto-extracted fields. They could be missing for a variety of reasons. For example:

• You may be building your data model prior to indexing the data that will make up its dataset.
• You are indexing data, but certain rare fields that you expect to see eventually haven't been indexed yet.
• You are utilizing a generating search command like inputcsv that adds fields that don't display in this list.

You can manually add auto-extracted fields to a root dataset.

Note: Before adding fields manually, try increasing the event sample size as described in the procedure above to pull in rare fields that aren't found in the first thousand events.

1. Click Add by name in the top right-hand corner of the Add Auto-Extracted Field dialog.

   This adds a row to the field table. Note that in the example at the top of this topic a row has been added for a manually added ISBN field.

2. In that row, manually identify the Field name, Type, and status for an auto-extracted field.
3. Click Add by name again to add additional field rows.
4. Click the X in the top right-hand corner of an added row to remove it.
5. Click Save to save your changes.

   Fields that you've added to the table are added to your root dataset as Extracted in the Extracted category, along with any selected auto-extracted fields.