Field Extraction not working in ES App

[sumanssah]

Hello Experts,

I am facing difficulty while performing a search on ES App. While performing a search in ES App filed extraction is not working and the same search is showing alert all other apps. I checked for app permission and is set to Global for all apps.

Please help me with possible troubleshooting. Thanks in advance.

[harsmarvania57 · Accepted solution]

Hi,

If you are running ES 5.2 or lower and your field extractions is defined outside ES app then you need to import app/add-ons which has field extraction defined in ES. Have a look at https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#App_and_add-on_import_naming...

[sumanssah]

Thanks @harsmarvania57