> ## Documentation Index
> Fetch the complete documentation index at: https://splunk-training.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Lab 16: Creating and Managing Fields

> Hands-on lab · 45 min · Module 20

Extract the user from Linux session events with the Field Extractor and check the values it finds.

[Launch Lab 16 in the IP Lab Portal](https://labs.intellectualpoint.com/labs/splunk-lab-16-creating-and-managing-fields)

## What you will do

1. Open the Field Extractor on Linux session events
2. Extract the user field
3. Validate the values it finds
4. Save the extraction

## Before you start

Time
45 minutes
*On your own Splunk lab machine*

Role
admin
*Every lab signs you in as admin*

Module
Module 20: Creating and Managing Fields
*SPK-102*

* Click **Launch Lab 16 in the IP Lab Portal** to open the lab page, then click **Launch** to start your machine.
* Starting a lab counts as an attempt. Tick off steps in the lab guide to track your progress.
* The course data is `access_30DAY.log`, `linux_s_30DAY.log`, `db_audit_30DAY.csv` and `products.csv`.
* Review the slides in [Module 20 Material](https://splunk-training.ipoint-labs.com/spk-102/module-20/material.md) before you start.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.