I upgraded to 6.0 and now my field extractions don't work at all. In fact I don't get any fields extracted when I run a search from the search bar.

[DerekB]

I upgraded to 6.0 and now my field extractions don't work at all. In fact I don't get any fields extracted when I run a search from the search bar.

What do I do to fix this?

[Flynt · Accepted solution]

One thing to make sure of (especially if upgrading from a much earlier version of Splunk) is that you are not set to search in Fast mode -

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Changethesearchmode

Note this point especially -

Fast Mode

Disables field discovery. Field discovery is the process Splunk uses to extract fields aside from default fields such as host, source, and sourcetype. This means that Splunk only returns information on default fields and fields that are required to fulfill your search (if you are searching on certain fields, it will extract those fields).

Try searching in verbose mode and see if your extractions now appear.