A temporary field is a field that exists as part of a query, but is not saved globally within a VMware Aria Operations for Logs instance or as part of an installed content pack.
VMware Aria Operations for Logs reduces the chances of creating a temporary field by automatically updating the query that relies on a field being modified.
You can see temporary fields when you run a saved query in the Interactive Analysis page and a field used in the saved query contains the namespace Temporary to the right of the field name.
Queries to contain one or more fields. For saved queries in VMware Aria Operations for Logs the field definition used when a query is saved will be modified if the field is modified. Field modifications include
- Changing the field value
- Changing the regex before value and the regex after field value
- Changing the name of the field
- Deleting the field
When you export a content pack VMware Aria Operations for Logs converts all temporary fields to content pack fields. If you see a temporary field in a content pack, you might be looking at a content pack from a previous product version that is exported with temporary fields, or the content pack is manually edited.
If a temporary field exists with the same name as an existing extracted field, the temporary field displays ending in {n}. For example, if you have a field called product_test_field, product_test_field {2} might also be visible during export. If you see this behavior, a temporary field exists. To address the issue, choose the Select None option at the bottom of the export dialog box and select each dashboard and/or alert until the extract field(s) with the {n} ending are checked. Go to those dashboards and/or alerts and edit each query. When you find a query using the extracted field, change the filter or aggregation to use the field without the {n} ending, run the query, and save the query. After you complete these steps for all queries using a field ending in {n}, the field no longer displays during export.
