CEF parsing on under Splunk Enterprie Security App

[riqbal47010]

I have strange issue,
I am receiving logs in CEF format from fireeye under index=fireeye. On search Head I am seeing fields being properly extracted under CEF format but on ES app, it is not showing as on search head. on both ends I have same type of packages installed. Is ES app stops CEF format field extraction ?

[tiaatim]

Did you ever figure this out? I'm experiencing the same issue.