Splunk Search

Field extraction

Path Finder


I am using props.conf to do field extraction and looks like working fine.
But I don't see them in Search APP..However, I am seeing them in sample_log search head.
here is example:

props conf:

EXTRACT- = USER\sHOME:\s(?\w:[\w|\|\w|\s]*)

when I use "Search APP"; I don't see the Extract field but if I open "sampledevsearchhead", I can see it. How can I configure the extract fields so that they can be seen in any App?

Thank You.

Tags (2)
0 Karma

Re: Field extraction

Splunk Employee
Splunk Employee

You'll want to go to Manager » Fields » Field extractions, find your extraction and change the permissions to be global.