Implementing Splunk 7, Third Edition - Third Edition

Editing fields (attributes)

Let's add an auto-extracted attribute, as mentioned earlier in this chapter, to our data model. Remember, auto-extracted attributes are derived by Splunk at search time. To start, click on Add Field:

Next, select Auto-Extracted. The Add Auto-Extracted Field window opens:

You can scroll through the list of automatically extracted fields and check the fields that you want to include. Since my data model example deals with errors that occurred, I've selected date_mday, date_month, and date_year.

Notice that to the ...