split by inputs

I pressed Input of System and created a rule of log extraction from Manage extractors.
After confirming that the extraction settings created from Search are displayed on the log,
On the dashboard screen, the created extraction settings are not displayed in ROWS and cannot be selected.
Is there any rule until it is displayed after several hours have passed?


Correct me if I’m wrong, you created an INPUT with extractors? The logs now have this new Field you wanted, and you can see it in the logs?

When creating a dashboard you cannot see this information from the new fields made from the extractors?
If this is correct, then you can do this a couple of ways.

In your INPUT go to show all messages and find the new field made from the extractor. There should be an arrow next to the field, click that arrow and then a window should pop out and click on 'Show Top values" as shown below.

Now copy it to your dashboard. You will see this below.

If that doesnt work can you show us in greater detail on whats happening in your envirnoment?

Thank you for your answer.
With the procedure you taught me, I was able to reflect it on the dashboard.
It was helpful!

Glad I could help. There are other ways of doing this but I thought this would be the easiest one for you.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.