Splunk Search

How do I export extracted fields for use in another app?

adamfrisbee
Explorer

I am creating two apps that use the same data (weird,I know, but I am testing something in my environment). I've built one app, and used the field extractor to extract about five custom fields. I need to export/import them into another app, but I can't find them in the config files. Does anyone know where extracted fields are stored in the file system for custom apps?

Tags (1)
0 Karma
1 Solution

alonsocaio
Contributor

I guess It is a permission issue.

If the permissions to this new field extraction are set to owner, you should take a look at SPLUNK_HOME/etc/users/USERNAME/APP_NAME/local/props.conf.

If they are set to this app only, check SPLUNK_HOME/etc/apps/APP_NAME/local/props.conf.

View solution in original post

0 Karma

alonsocaio
Contributor

I guess It is a permission issue.

If the permissions to this new field extraction are set to owner, you should take a look at SPLUNK_HOME/etc/users/USERNAME/APP_NAME/local/props.conf.

If they are set to this app only, check SPLUNK_HOME/etc/apps/APP_NAME/local/props.conf.

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...