Splunk Enterprise Security

How to see newly created calculated field/field alias/field extraction in the logs ?

sohailmohammed
Path Finder

Hi All,

I have created a newly created field/field alias/field extraction with GLOBAL Permissions.

Example | eval test="MyApp"

This works fine when I use it in search but when I save it as calculated field it doesn't show up.  I refreshed 10 times even cleared browser cache and logged back in. Still same issue. We don't see newly created KO in the logs but can run those in searches.

Any inputs or help 

@woodcock @Splunkers 2022 

0 Karma
Get Updates on the Splunk Community!

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...