Are you extracting the controller field?

[aalapsharma]

I do not see it in the props.conf

[aalapsharma]

Sorry I thought the question would be directed to the creator of the app. However I used the interactive field extractor and its pretty cool.

[sdaniels · Accepted solution]

It might help to provide more information and context to your issue. Reading a couple of the docs should help you. There are several reasons that you may not be seeing a field. Your user might not have the permissions, there might not be a configuration to extract the field at search time etc... You could always add a field using the interactive field extractor (here).

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Addfieldsatsearchtime

There are also several places to look for configuration files:
http://docs.splunk.com/Documentation/Splunk/6.0/admin/Wheretofindtheconfigurationfiles

[lukejadamec]

A little more info. We are a very distributed system with a slow bus speed.