I am creating two apps that use the same data (weird,I know, but I am testing something in my environment). I've built one app, and used the field extractor to extract about five custom fields. I need to export/import them into another app, but I can't find them in the config files. Does anyone know where extracted fields are stored in the file system for custom apps?
I guess It is a permission issue.
If the permissions to this new field extraction are set to owner, you should take a look at SPLUNK_HOME/etc/users/USERNAME/APP_NAME/local/props.conf.
If they are set to this app only, check SPLUNK_HOME/etc/apps/APP_NAME/local/props.conf.
I guess It is a permission issue.
If the permissions to this new field extraction are set to owner, you should take a look at SPLUNK_HOME/etc/users/USERNAME/APP_NAME/local/props.conf.
If they are set to this app only, check SPLUNK_HOME/etc/apps/APP_NAME/local/props.conf.