Deleted the field extraction , but still field is showing in Splunk

[Dharani]

Hi Splunkers ,

Initially I have created on field extraction based on source type in Splunk. After that I wanted to modify the field extraction. When I modified that the new field extraction was not working , old field extractions only working. So I deleted that to create a new one.

After deleted the field extraction also , I can see the old fields are showing in Splunk. Now I am not able to over write this also. I have tried search level and indexer level extraction , nothing is working.

I am only getting the old fields are extracting now. I need to remove the old fields and want to create a new one.

Can anyone help one this case.

Thanks in Advance !

[scelikok]

Hi @Dharani,

You can use btool to see which setting is active to find and delete.

$SPLUNK_HOME/bin/splunk btool props list <your_sourcetype> --debug

If this reply helps you an upvote is appreciated.

[Dharani]

Hi @scelikok ,

Thanks for you response, 

I tried this, but not getting anything.

Now I am not able to apply anything (like field extraction , calculated field) on the particular source type. Don't know what could be the issue.