You can duplicate an extracted field.

You use the Duplicate option when you want to extract more than one field from an event and both fields appear in a similar context. After you extract a field and save it, open the extracted field definition and use the Duplicate option. The duplicated field has the exact same definition as the original extracted field. You can modify the definition of the duplicated field to match another value in the event that interests you.

You can duplicate only fields that have the Edit this field icon Click to edit next to their names. Normal users can duplicate only their own content. Administrator users can modify their own content and their shared content.

Verify that you are logged in to the Log Insight Web user interface. The URL format is https://log_insight-host, where log_insight-host is the IP address or host name of the Log Insight virtual appliance.

1

Navigate to the Interactive Analytics tab.

2

In the list of fields to the right, select the field that you want to duplicate, and click the Edit this field icon Click to edit. If the field does not appear in the list, click the Manage extracted fields icon Click to edit above the list and select a field.

3

Click Duplicate to create a copy of the field.

4

Modify the Value regular expression in the Fields pane.

5

Modify the Context regular expression in the Fields pane.

6

If you are an administrator user, select which users can access the field.

Option

Description

All users

All users will see the field in the search drop-down menu.

Me only

Other users will not see the field in the Search drop-down menu.

7

Click Save.

You can use the extracted field to search and filter the list of log events, or to aggregate events in the Interactive Analytics chart.

You can modify saved field definitions or delete them if you no longer need them.