All Apps and Add-ons

Splunk Field Extraction app

The source for an app is not displaying in the Splunk, when using The extraction tool -UFX

0 Karma

App is running on the search head. How do configure that app to look for the logs on the windows forwarders?

0 Karma

Splunk Employee
Splunk Employee

Try upgrading to 6.3. There are a lot of enhancements to Splunk core and the IFX!

0 Karma

App is running on the search head. How do configure that app to look for the logs on the windows forwarders?

0 Karma

how do we omit one of the search results this is the extraction we are using but it shows one of the unwanted results
PROCESSSTATUS - (?P\D+)

we just want Pro APPROVED but it is also giving us PREP APPROVED 11/15/25 3:00:00 PM ........

0 Karma

Contributor

Can you provide sample logs? I'd be happy to write a regex for you.

0 Karma

This app is working for linux based forwarders but I condifugred inputs for windows logs and those windows logs are not coming up in splunk

0 Karma

we can see the linux path in the drop down not the windows paths to the logs

0 Karma

Splunk Employee
Splunk Employee

Where are you running the app? Should be on the search head, not forwarders.

0 Karma

Please find screenshot of the app

0 Karma

Communicator

@Fatimabegum12 is Splunk's built in field extractor tool not working for you? I can walk you through using that field extractor.

0 Karma

alt text

0 Karma

Splunk version 6.0.7
Field Extractor App (UFX)

In the pick a source field we are not able to not able to see the new log paths we configured on our windows forwarder.

monitor stanza is only configured on the forwarder only not on the indexer.

0 Karma

Hi chris,
can you please help here

0 Karma

Splunk Employee
Splunk Employee

I have not actually used the app, so I can't offer any insight. Hopefully the information you have now provided will enable other community members to answer. There is a built-in interactive field extraction feature in Splunk Enterprise 6, see Extract fields interactively with IFX and Use the Field Extractions page in Splunk Web in the Knowledge Manager Manual for information about that.

0 Karma

Can someone pleas help with this issue?

0 Karma

Splunk Employee
Splunk Employee

Please provide additional details so the community can help you. What version of Splunk Enterprise are you using, what is the app you refer to, what steps are you taking, can you provide any sample searches and results...?

0 Karma