You can duplicate an extracted field.
You use the Duplicate option when you want to extract more than one field from an event and both fields appear in a similar context. After you extract a field and save it, open the extracted field definition and use the Duplicate option. The duplicated field has the exact same definition as the original extracted field. You can modify the definition of the duplicated field to match another value in the event that interests you.
Normal users can duplicate only their own content. Administrator users can modify their own content and their shared content.
Verify that you are logged in to the vRealize Log Insight web user interface. The URL format is https://log_insight-host, where log_insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.
- Navigate to the Interactive Analytics tab.
- At the top of the Fields pane, click Manage extracted fields and select an extracted field from the list.
- Click Duplicate to create a copy of the field.
- (Optional) Modify the Extracted value regular expression in the Fields pane.
- (Optional) Modify the Pre and post context regular expressions in the Fields pane.
- (Optional) Click Add additional context to add more keywords and filters.
You can add one or more keywords and use a single static field as a filter.
- If you are an administrator user, select which users can access the field from the drop down menu.
All users will see the field in their events and in the filter drop-down menu.
Only the creator of the field will see the field in their events and filter drop down menu.
- Click Save.
What to do next
You can use the extracted field to search and filter the list of log events, or to aggregate events in the Interactive Analytics chart.
You can modify saved field definitions or delete them if you no longer need them.