https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37178#M1674 <P>Since I don't see much documentation for this app, what needs to be set in order for the lookups to happen? Do I need to change sourcetype, source?</P> Thu, 26 Apr 2012 14:59:54 GMT gregwilliams 2012-04-26T14:59:54Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37178#M1674 <P>Since I don't see much documentation for this app, what needs to be set in order for the lookups to happen? Do I need to change sourcetype, source?</P> Thu, 26 Apr 2012 14:59:54 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37178#M1674 gregwilliams 2012-04-26T14:59:54Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37179#M1675 <P>Did you go through this below. It has the details that you need to create a lookup. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/User/Fieldlookupstutorial">http://docs.splunk.com/Documentation/Splunk/4.3.2/User/Fieldlookupstutorial</A></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources</A></P> Thu, 26 Apr 2012 15:05:18 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37179#M1675 sdaniels 2012-04-26T15:05:18Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37180#M1676 <P>The main thing is to make sure your sourcetype is set to <CODE>ias</CODE>.</P> Thu, 26 Apr 2012 23:27:51 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37180#M1676 southeringtonp 2012-04-26T23:27:51Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37181#M1677 <P>got it. I still see default logs however. Do I need to put something else in my search string except for sourcetype=ias?</P> Fri, 27 Apr 2012 14:43:46 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37181#M1677 gregwilliams 2012-04-27T14:43:46Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37182#M1678 <P>Not sure I follow. Are you expecting to see a difference in the log entries themselves? The lookup values appear as new extracted fields, so you should start to see them in the field picker at the left. You might need to click <CODE>pick fields</CODE> to bring up the full list.</P> Sat, 28 Apr 2012 00:11:27 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Field-Extractions-for-IAS-app/m-p/37182#M1678 southeringtonp 2012-04-28T00:11:27Z