Getting Data In

Extracted fields details are present in which directory ?

Madhan45
Path Finder

I have extracted a new field. the details about that field where would be present? in splunk home?

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The config for newly created field extractions sits in $SPLUNK_HOME/etc/users/your_user/your_app/local/props.conf. Once shared to the app or globally it'll sit in $SPLUNK_HOME/etc/apps/your_app/local/props.conf.

richgalloway
SplunkTrust
SplunkTrust

What details are you hoping to find?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...