Is there a way to figure how which config file is causing a particular field extraction at search time?
Thx.
C
No. But you can see which extractions have been accepted by Splunk and from what application.
At the command line from SPLUNK_HOME/bin run the following command;
./splunk cmd btool
Where
Otherwise, if it is a search time extraction you can comment out all of the REPORT or EXTRACT lines in props and slowly re-introduce them. On 4.3 each time you run a search it will reload the search time extractions so there is no need to restart each time you comment or uncomment one line.