topic Re: Extracted fields details are present in which directory ? in Getting Data In

Extracted fields details are present in which directory ?

Madhan45 — Wed, 08 Jul 2015 12:51:34 GMT

I have extracted a new field. the details about that field where would be present? in splunk home?

Re: Extracted fields details are present in which directory ?

richgalloway — Wed, 08 Jul 2015 13:08:23 GMT

What details are you hoping to find?

Re: Extracted fields details are present in which directory ?

martin_mueller — Wed, 08 Jul 2015 13:11:07 GMT

The config for newly created field extractions sits in $SPLUNK_HOME/etc/users/your_user/your_app/local/props.conf. Once shared to the app or globally it'll sit in $SPLUNK_HOME/etc/apps/your_app/local/props.conf.