topic Re: Field Extraction not working in ES App in Splunk Enterprise Security

Field Extraction not working in ES App

sumanssah — Tue, 30 Jul 2019 16:45:04 GMT

Hello Experts,

I am facing difficulty while performing a search on ES App. While performing a search in ES App filed extraction is not working and the same search is showing alert all other apps. I checked for app permission and is set to Global for all apps.

Please help me with possible troubleshooting. Thanks in advance.

Re: Field Extraction not working in ES App

harsmarvania57 — Wed, 31 Jul 2019 08:44:07 GMT

Hi,

If you are running ES 5.2 or lower and your field extractions is defined outside ES app then you need to import app/add-ons which has field extraction defined in ES. Have a look at https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#App_and_add-on_import_naming_conventions

Re: Field Extraction not working in ES App

sumanssah — Thu, 01 Aug 2019 05:33:09 GMT

Thanks @harsmarvania57