Universal Forwarder field extractions not working

[bobdoyle]

I'm troubleshooting an issue with the Splunk for Exchange App. While, I've been getting the message tracking logs from my Hub/Transport server the field extractions that are configured in the props.conf and transforms.conf for the deployed apps don't seem to be working.

Are the results of these extractions logged somewhere on the forwarder? Where should I be looking for more info to troubleshoot this?

[ahall_splunk]

Within Splunk_for_Exchange/appserver/static, there is a fwd-apps.zip file that contains the right field extractions. Unpack this ZIP file in $SPLUNK_HOME/etc/apps (or, on a Windows box - %SPLUNK_HOME%\etc\apps)

[malmoore]

We're actively working on updating the documentation so that the process around distributing these components is clearer.

[mcluver]

I'm having the same problem and your explanation here is far from detailed. Does this mean to move a copy of the fwd_* folders from %SPLUNK_HOME%\etc\deployment-apps to %SPLUNK_HOME%\etc\apps and restart Splunk?

[ahall_splunk · Accepted solution]

You need to place the fwd_* apps on the search head as well as the Universal Forwarders