Splunk Search

Field extraction

gudavasr
Path Finder

Hi,

I am using props.conf to do field extraction and looks like working fine.
But I don't see them in Search APP..However, I am seeing them in sample_log search head.
here is example:

props conf:

[sample_log]
EXTRACT- = USER\sHOME:\s(?\w:[\w|\|\w|\s]*)

when I use "Search APP"; I don't see the Extract field but if I open "sample_dev_searchhead", I can see it. How can I configure the extract fields so that they can be seen in any App?

Thank You.

Tags (2)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

You'll want to go to Manager » Fields » Field extractions, find your extraction and change the permissions to be global.

Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...