Splunk Search

How do I export extracted fields for use in another app?

adamfrisbee
Explorer

I am creating two apps that use the same data (weird,I know, but I am testing something in my environment). I've built one app, and used the field extractor to extract about five custom fields. I need to export/import them into another app, but I can't find them in the config files. Does anyone know where extracted fields are stored in the file system for custom apps?

Tags (1)
0 Karma
1 Solution

alonsocaio
Contributor

I guess It is a permission issue.

If the permissions to this new field extraction are set to owner, you should take a look at SPLUNK_HOME/etc/users/USERNAME/APP_NAME/local/props.conf.

If they are set to this app only, check SPLUNK_HOME/etc/apps/APP_NAME/local/props.conf.

View solution in original post

0 Karma

alonsocaio
Contributor

I guess It is a permission issue.

If the permissions to this new field extraction are set to owner, you should take a look at SPLUNK_HOME/etc/users/USERNAME/APP_NAME/local/props.conf.

If they are set to this app only, check SPLUNK_HOME/etc/apps/APP_NAME/local/props.conf.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...