Knowledge Management

Field extraction using delimiter


I am having Structure data files for which I did field extraction using Splunk field delimiter in development box. when I packaged the app and placed it in production it is not working.

I checked the permission and it is global.

data looks like this 

file name windows_patch.log

13-01-2021 12:09:39 PM~^~SAP,SQL,Oracle~^^~Connect to WSUS~^~Success~^~WinRM service is already running on this machine.\r\nWinRM is already set up for remote management on this computer.\r\n~^~ Connected to WSUS successfully.
13-01-2021 12:09:41 PM~^~SAP,SQL,Oracle~^^~Loading PowerShell Modules on Target Host~^~Success~^~\nPowershell Output:\n~^~Fetch patches details successfully to apply on Target


REPORT-Patch-Windows_Pre_Patching = REPORT-Patch-Windows_Pre_Patching



DELIMS = "~^~"
FIELDS = "Step_Execution_Time","field2","field3","Applications","field5","field6","Server","field8","field9","Step_Name","field11","field12","Step_Status","field14","field15","Step_Logs","field17","field18","Step_Comment","Step_Comment"


please guide

Labels (1)
0 Karma


Hi @ChetanArgekar ,

If it is working in a test environment then it should work in production as well.

Run a btool command and see what is the issue

And also check the local. meta for that app.

And also how are you checking the extractions? Are you running the search in fast mode? 

Run a search in verbose mode and see. And make sure you have selected the All fields.



0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...