topic Re: New field extractions not showing up in search (verbose mode) in Splunk Search

Why are new field extractions not showing up in search (verbose mode)?

corehan — Tue, 05 Apr 2022 15:03:28 GMT

Hello dears,

I deleted my custom field which I created before but still extract in search results. Also, I'm trying a new field extract ( sampling is fine ) but it doesn't show in search ( verbose mode ). Do you have any idea, why?

Regards.

Re: New field extractions not showing up in search (verbose mode)

VatsalJagani — Tue, 05 Apr 2022 06:08:00 GMT

Make sure you are running the search query from the same App in which you created/changed the extraction.

Try running this search:

<your search query> | extract reload=T

(If you have not restarted the Splunk this will reload the props configuration changes)

If you still do not see changes, run the below command from the backend to see if Splunk got new changes. (There could be a possibility that your changes are in the file which has lower precedence.)

.splunk show config props

I hope this helps!!

Re: New field extractions not showing up in search (verbose mode)

corehan — Wed, 06 Apr 2022 11:52:44 GMT

Hi,

- search | extract reload : didn't work

- Server restart : didn't work

- splunk show config props : I didn't try, i'm waiting for admin return because is enterprise product.

Thank you for suggests

Regards.