Hi, I have a field called UserID appearing in my searches that in two of my sourcetypes within the same index. Ive scoured the GUI manager looking for UserID and it is nowhere to be found, i have checked every props.conf file i can find on the box itself and i dont see that field extraction anywhere. I have tried restarting the server but the field keeps popping up. I want very desperately to edit that regex to make it work properly but I cant find it to edit it. Can anybody help? Is there a secret place where field type regexes are kept in splunk?
↧