Unable to find from where a field is being extracted

[maniu1609]

I have checked all my forwarder and indexer and search head apps. but unable to find from where a field it's extracted.

[somesoni2]

The field extraction can be set based on sourcetype, source OR host. So make sure you're looking for all relevant stanzas for your sourcetype/source/host. They can be extracted (EXTRACT/REPORT/TRANSFORM in props.conf) , calculated (EVAL in props.conf) OR derived (using lookups).

Do you see the value of the extracted field in your raw data?

[FrankVl]

How did you check all the apps? Manually, or by running btool?

Might be helpful if you provide a bit more info of what you are investigating...

[p_gurav]

Are you using any app or add-on for data indexing?