https://community.splunk.com/t5/Splunk-Enterprise/Field-extractions-not-getting-replicated-on-Search-head/m-p/491518#M9480 <P>@rashi83 - In the distributed environment, you need to deploy this app on Search head as well along with the Heavy forwarder. May be this documentation will help <A href="https://raw.githubusercontent.com/mbegan/Okta-Identity-Cloud-for-Splunk/master/README/Okta%20Identity%20Cloud%20Add-on%20for%20Splunk.pdf">https://raw.githubusercontent.com/mbegan/Okta-Identity-Cloud-for-Splunk/master/README/Okta%20Identity%20Cloud%20Add-on%20for%20Splunk.pdf</A></P> Tue, 05 May 2020 23:31:26 GMT Vijeta 2020-05-05T23:31:26Z https://community.splunk.com/t5/Splunk-Enterprise/Field-extractions-not-getting-replicated-on-Search-head/m-p/491515#M9477 <P>Hi, </P> <P>I m using app - OKTA identity cloud deployed on Indexer has built -in sourcetype OktaIM2:log - field extractions . I am seeing those fields when I am running query on Indexer . But the same query when run on Search head , I am seeing less field extractions - specially the ones in advanced section . Attached is the screenshot of the advanced setting of sourcetype. </P> <P>Why is this happening ? I have not faced this issue before ?</P> Tue, 05 May 2020 21:39:46 GMT https://community.splunk.com/t5/Splunk-Enterprise/Field-extractions-not-getting-replicated-on-Search-head/m-p/491515#M9477 rashi83 2020-05-05T21:39:46Z https://community.splunk.com/t5/Splunk-Enterprise/Field-extractions-not-getting-replicated-on-Search-head/m-p/491516#M9478 <P>Is there same props.conf and transforms.conf?</P> Tue, 05 May 2020 22:30:02 GMT https://community.splunk.com/t5/Splunk-Enterprise/Field-extractions-not-getting-replicated-on-Search-head/m-p/491516#M9478 to4kawa 2020-05-05T22:30:02Z https://community.splunk.com/t5/Splunk-Enterprise/Field-extractions-not-getting-replicated-on-Search-head/m-p/491517#M9479 <P>@to4kawa : There is props and transforms in default folder . What is the question - is it same ? NO.</P> Tue, 05 May 2020 23:25:54 GMT https://community.splunk.com/t5/Splunk-Enterprise/Field-extractions-not-getting-replicated-on-Search-head/m-p/491517#M9479 rashi83 2020-05-05T23:25:54Z https://community.splunk.com/t5/Splunk-Enterprise/Field-extractions-not-getting-replicated-on-Search-head/m-p/491518#M9480 <P>@rashi83 - In the distributed environment, you need to deploy this app on Search head as well along with the Heavy forwarder. May be this documentation will help <A href="https://raw.githubusercontent.com/mbegan/Okta-Identity-Cloud-for-Splunk/master/README/Okta%20Identity%20Cloud%20Add-on%20for%20Splunk.pdf">https://raw.githubusercontent.com/mbegan/Okta-Identity-Cloud-for-Splunk/master/README/Okta%20Identity%20Cloud%20Add-on%20for%20Splunk.pdf</A></P> Tue, 05 May 2020 23:31:26 GMT https://community.splunk.com/t5/Splunk-Enterprise/Field-extractions-not-getting-replicated-on-Search-head/m-p/491518#M9480 Vijeta 2020-05-05T23:31:26Z