<%inherit file="//layout/base.html" /> <%namespace name="lib" file="//lib.html" import="*" /> <%def name="js()"> <%def name="css()"> <%coreCSSFiles = ["/static/css/view.css", "/static/css/skins/default/default.css", '/modules/nav/AccountBar.css', '/static/css/print.css'] %> <%lib:stylesheet_tags files="${coreCSSFiles}" compile="False" /> <%def name="body_element_open()">

${_('Extract fields')}

% if len(successmessage) == 0: ${message} % endif
${_('Interactive Field Extractor')}

${_('Teach Splunk how to extract fields by providing it with example values. First, restrict the
field extraction to a specific host, source, or sourcetype. Then, copy and paste example
values of the field you want Splunk to extract.')}

% if sid == "" or soffset == "":

${_('Enter a simple search. Splunk uses the first search result to populate the selection list below.')}

% endif

${_('Enter one or more example values on separate lines. For best results, include multiple examples. ')}


${_('Generated pattern (regex)')}

% if len(regex) > 0:
    ${regex|h}
% else:

<none>

% endif
<% disabledrevert = disabledsave = '' %> <% if not edited: disabledrevert = 'disabled="disabled"' %> % if len(regex)> 0 and testingurl != None: % endif

${_('Sample extractions')}

% if not edited and "<none>" not in extractions:

${_('Validate the extracted values. To improve results, remove incorrect extractions and add more example values.')}

% endif
${extractions}

${_('Sample events')}

${_('This list is based on the event you selected from your search and the field restriction you specified.')}

% for event in events: % endfor
${event}

${_('Save Field Extraction')}

${_('Note: To ensure the regex works properly, test before you save it.')}

${_('Edit Regex')}

${_('Note: FIELDNAME is a placeholder name that will be replaced when you save the regex. Do not change it.')}

${_('Test Regex')}

${_('A new Splunk search window will open and allow you to verify that your field is being properly extracted with the values you want.')}

${_('When you are done testing your field, close the search testing window and return to the Extract Fields window to save your extracting regex or further refine it.')}

${_('Note: The first time you run Test you will need to add the "FIELDNAME" field to the list of fields to display.')}

${_('Successfully Saved Regex')}

${_('Your field extraction has been saved.')}