Splunk Enterprise Security

Why do I receive different results between two different applications?

jwhughes58
Contributor

I have a simple search

index=myIndex sourcetype=mySourcetype

If I run the search in the Splunk Enterprise Security app I get src_ip. If I run the search in a different app, I don't get src_ip. I need leads on how to figure out why this is happening. Any leads?

TIA,
Joe

0 Karma
1 Solution

dineshraj9
Builder

Check Fields -> Extractions in the Splunk Enterprise Security App. There would be an EXTRACT written to extract such fields. You can add the same in your app or set the permissions of the existing EXTRACT to global to leverage the same behaviour across all apps.

View solution in original post

dineshraj9
Builder

Check Fields -> Extractions in the Splunk Enterprise Security App. There would be an EXTRACT written to extract such fields. You can add the same in your app or set the permissions of the existing EXTRACT to global to leverage the same behaviour across all apps.

jwhughes58
Contributor

It was a permissions issue on the extracts. They were set to app only. When I changed them to global the search in the other app started working.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...