You can delete extracted fields that are no longer needed.

Log Insight creates copies of the fields that you use when you create widgets, queries, or alerts. If you delete a field that is used in widgets, queries, or alerts, Log Insight creates a temporary copy of the deleted field for each widget, query, or alert that uses that field.

You can delete only fields that have the Edit this field icon Click to edit next to their names. Normal users can delete only their own content. Administrator users can delete their own content and their shared content.

Content pack fields are read-only.

Verify that you are logged in to the Log Insight Web user interface. The URL format is https://log_insight-host, where log_insight-host is the IP address or host name of the Log Insight virtual appliance.

1

Navigate to the Interactive Analytics tab.

2

In the list of fields to the right, select the field that you want to delete, and click the Edit this field icon Click to edit.

The field properties appear.

If the field does not appear in the list, click the Manage extracted fields icon Click to edit above the list. Hover over the name of the field you want to delete and click the red X.

3

Click Delete.

A dialog box displays a list of content that uses the field that you want to delete. If you are an administrator user, and the field is shared by multiple users, the dialog box also displays a list of affected users.

4

Click Delete to confirm.

If a deleted field is used in existing queries, Log Insight creates a temporary copy of the field and displays it when you load a query that uses the deleted field.

If you export content that contains temporary fields, Log Insight creates the fields in the exported content pack to avoid temporary fields.