All Apps and Add-ons

Fields only parsing in the Windows DHCP App

Ronvgraham
Engager

I would like to have the DHCP records parsed in the main search app the same as they are in the Windows DHCP app. I have attempted to move the files from the default and lookup folder to the /etc/local folder in the search app. Unfortunately, it does not appear to be parsing the fields from the logs in the same manner as the DHCP app.

Is there instructions on what I need to do to get the fields to parse correctly in the Search & Reporting app so I can match the logs to other sources?

Tags (1)
0 Karma
1 Solution

okrabbe_splunk
Splunk Employee
Splunk Employee

Go to settings -> fields -> field extractions.

Find your field extraction in the list. You will then see a move link under actions and you can move the extractions to the search app.

Your other option would be to make the field global. You can do this from the same list by clicking on "permissions" and saying that the object should appear in all apps.

This is a common question. You can see another example response at this link :
http://answers.splunk.com/answers/86/how-do-i-share-all-of-the-field-extractions-defined-in-a-given-...

View solution in original post

0 Karma

Ronvgraham
Engager

I did not have the move link in the version of Splunk I am currently running 6.0. The permissions did fix the problem though. Thank you very much for your help

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Go to settings -> fields -> field extractions.

Find your field extraction in the list. You will then see a move link under actions and you can move the extractions to the search app.

Your other option would be to make the field global. You can do this from the same list by clicking on "permissions" and saying that the object should appear in all apps.

This is a common question. You can see another example response at this link :
http://answers.splunk.com/answers/86/how-do-i-share-all-of-the-field-extractions-defined-in-a-given-...

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...