All Apps and Add-ons

Field Extractions for IAS app

gregwilliams
Path Finder

Since I don't see much documentation for this app, what needs to be set in order for the lookups to happen? Do I need to change sourcetype, source?

0 Karma

southeringtonp
Motivator

The main thing is to make sure your sourcetype is set to ias.

0 Karma

southeringtonp
Motivator

Not sure I follow. Are you expecting to see a difference in the log entries themselves? The lookup values appear as new extracted fields, so you should start to see them in the field picker at the left. You might need to click pick fields to bring up the full list.

0 Karma

gregwilliams
Path Finder

got it. I still see default logs however. Do I need to put something else in my search string except for sourcetype=ias?

0 Karma

sdaniels
Splunk Employee
Splunk Employee
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.