https://community.splunk.com/t5/Splunk-Search/Are-you-extracting-the-controller-field/m-p/86005#M21955 <P>Sorry I thought the question would be directed to the creator of the app. However I used the interactive field extractor and its pretty cool.</P> Mon, 07 Oct 2013 23:26:35 GMT aalapsharma 2013-10-07T23:26:35Z https://community.splunk.com/t5/Splunk-Search/Are-you-extracting-the-controller-field/m-p/86002#M21952 <P>I do not see it in the props.conf</P> Mon, 07 Oct 2013 23:05:48 GMT https://community.splunk.com/t5/Splunk-Search/Are-you-extracting-the-controller-field/m-p/86002#M21952 aalapsharma 2013-10-07T23:05:48Z https://community.splunk.com/t5/Splunk-Search/Are-you-extracting-the-controller-field/m-p/86003#M21953 <P>A little more info. We are a very distributed system with a slow bus speed.</P> Mon, 07 Oct 2013 23:12:54 GMT https://community.splunk.com/t5/Splunk-Search/Are-you-extracting-the-controller-field/m-p/86003#M21953 lukejadamec 2013-10-07T23:12:54Z https://community.splunk.com/t5/Splunk-Search/Are-you-extracting-the-controller-field/m-p/86004#M21954 <P>It might help to provide more information and context to your issue. Reading a couple of the docs should help you. There are several reasons that you may not be seeing a field. Your user might not have the permissions, there might not be a configuration to extract the field at search time etc... You could always add a field using the interactive field extractor (<A href="http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ExtractfieldsinteractivelywithIFX">here</A>).</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Addfieldsatsearchtime">http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Addfieldsatsearchtime</A></P> <P>There are also several places to look for configuration files:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.0/admin/Wheretofindtheconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/6.0/admin/Wheretofindtheconfigurationfiles</A></P> Mon, 07 Oct 2013 23:17:10 GMT https://community.splunk.com/t5/Splunk-Search/Are-you-extracting-the-controller-field/m-p/86004#M21954 sdaniels 2013-10-07T23:17:10Z https://community.splunk.com/t5/Splunk-Search/Are-you-extracting-the-controller-field/m-p/86005#M21955 <P>Sorry I thought the question would be directed to the creator of the app. However I used the interactive field extractor and its pretty cool.</P> Mon, 07 Oct 2013 23:26:35 GMT https://community.splunk.com/t5/Splunk-Search/Are-you-extracting-the-controller-field/m-p/86005#M21955 aalapsharma 2013-10-07T23:26:35Z