Fields only parsing in the Windows DHCP App

[Ronvgraham]

I would like to have the DHCP records parsed in the main search app the same as they are in the Windows DHCP app. I have attempted to move the files from the default and lookup folder to the /etc/local folder in the search app. Unfortunately, it does not appear to be parsing the fields from the logs in the same manner as the DHCP app.

Is there instructions on what I need to do to get the fields to parse correctly in the Search & Reporting app so I can match the logs to other sources?

[Ronvgraham]

I did not have the move link in the version of Splunk I am currently running 6.0. The permissions did fix the problem though. Thank you very much for your help

[okrabbe_splunk · Accepted solution]

Go to settings -> fields -> field extractions.

Find your field extraction in the list. You will then see a move link under actions and you can move the extractions to the search app.

Your other option would be to make the field global. You can do this from the same list by clicking on "permissions" and saying that the object should appear in all apps.

This is a common question. You can see another example response at this link :
http://answers.splunk.com/answers/86/how-do-i-share-all-of-the-field-extractions-defined-in-a-given-...