Modify Extraction for Existing Custom Fields
Need to have the ability to modify the extraction criteria for existing Custom Fields. I have added a handful based on SharePoint ULS, but they aren't always matching properly. The only way that I have found to "improve" them is to remove the column and re-add it again.
Matt
shared this idea
7 comments
-
Ajay J
commented
This is the same for Azure sentinel, any update?
-
Ryan
commented
This is a much needed feature. I have many CF's that are being used for alerts. We have alerts configured to email when a specific set of services enter a stopped state. New services have been created since the creation of the CF's. The extraction is not extracting the full name of the service. I need to edit the extraction rule to include this new service name, but cannot.
-
Anonymous
commented
Ran into this same issue! Created a bunch of custom field. Now I need to delete and re-create them as there still doesn't appear to be a way to edit.
-
Anonymous
commented
I could not agree more! This is essential. If nothing else Microsoft should allow us to write a CustomField parser that handles the parsing specifically if their attempt to match the field fails.
-
Tomas Charvat
commented
Hi, any news about this topic? I really need this for working with custom logs/custom fields
-
Stick it in Azure
commented
Any update on this? It seems like Custom Field extraction has been in preview forever! It's a very powerful component of Log Analytics which needs just a little more polish before being able to use it on a larger scale.
-
Timothy Bowen
commented
It would even be helpful to have more logs populated in the search summary after extracting a value, or an option to load more to improve the custom field more. We definitely need a way to further modify an existing custom field!