Field Extractor App V 1.6 with Splunk 6.0

[nehadoshi89]

We downloaded and installed the Field Extractor App Version 1.6 with Splunk Enterprise 6.0. We have two issues with using the app.

Issue 1: We used the app to extract 10 fields from a single log file. When the system was rebooted only 5 extractions are retained. We are on Splunk Enterprise version 6.0. Some of the rules that are defined in the app were saved while some rules were not saved after reboot. When the extraction is saved as a rule, they are reflected in the props.conf. Once the system is rebooted or when the data is re-indexed, the extractions are no longer listed when the search is initiated.

Issue 2: If we select one particular field e.g. SUCCESS for extraction, it highlights the SUCEESS field but in addition it also highlights some additional non-related data. The issue here is that when we click the “X” button it does not deselect the non-related data. Thus the appropriate field cannot be extracted correctly.

Thanks again. We love this App!

[carasso · Accepted solution]

1) If the settings are saved in props.conf, they are preserved after reboot.
If must be the case that the regexes are not matching your data. Also, make sure that you actually save each rule created, if there are multiple rules created.

2) Sometimes the app is not able to create a rule that extracts a value you want and not one you don't want. In that case, you'll have to edit the rule (by clicking on 'edit' in the ui)