Splunk Field Extraction app

[Fatimabegum12]

The source for an app is not displaying in the Splunk, when using The extraction tool -UFX

[Fatimabegum12]

App is running on the search head. How do configure that app to look for the logs on the windows forwarders?

[esix_splunk]

Try upgrading to 6.3. There are a lot of enhancements to Splunk core and the IFX!

[Fatimabegum12]

App is running on the search head. How do configure that app to look for the logs on the windows forwarders?

[Fatimabegum12]

how do we omit one of the search results this is the extraction we are using but it shows one of the unwanted results
PROCESSSTATUS - (?P\D+)

we just want Pro APPROVED but it is also giving us PREP APPROVED 11/15/25 3:00:00 PM ........

[hagjos43]

Can you provide sample logs? I'd be happy to write a regex for you.

[Fatimabegum12]

This app is working for linux based forwarders but I condifugred inputs for windows logs and those windows logs are not coming up in splunk

[Fatimabegum12]

we can see the linux path in the drop down not the windows paths to the logs

[esix_splunk]

Where are you running the app? Should be on the search head, not forwarders.

[Fatimabegum12]

Please find screenshot of the app

[jsven7]

@Fatimabegum12 is Splunk's built in field extractor tool not working for you? I can walk you through using that field extractor.

[Fatimabegum12]

[Fatimabegum12]

Splunk version 6.0.7
Field Extractor App (UFX)

In the pick a source field we are not able to not able to see the new log paths we configured on our windows forwarder.

monitor stanza is only configured on the forwarder only not on the indexer.

[Fatimabegum12]

Hi chris,
can you please help here

[ChrisG]

I have not actually used the app, so I can't offer any insight. Hopefully the information you have now provided will enable other community members to answer. There is a built-in interactive field extraction feature in Splunk Enterprise 6, see Extract fields interactively with IFX and Use the Field Extractions page in Splunk Web in the Knowledge Manager Manual for information about that.

[Fatimabegum12]

Can someone pleas help with this issue?

[ChrisG]

Please provide additional details so the community can help you. What version of Splunk Enterprise are you using, what is the app you refer to, what steps are you taking, can you provide any sample searches and results...?