I am not able to see my extracted field.
I can see the field created under splunk/etc/users/local
Also, I added the same to props.conf, but still I am not able to see the field in Splunk Web.
Where are you looking? The ones created using Extract New Fields show up under Settings > Fields > Field Extractions. When I run a search (and it finds data for it) it will show up in Interesting Fields or further below ###more fields.
If you go to
Settings -> Fields -> Field Extractions and select proper app, are you able to see those field extractions??/
It's also possible, that the field extracted shows up in a very lower percentage of events. If that's the case, it might not be automagically listed in the field list.
Click on All Fields
Below the words "Selected Fields" and the fields themselves are three links listed horizontally.
See where it says "Coverage 1% or more" ?
click it... it's a dropdown. Select ALL FIELDS.
Now search for your field.
splunk/etc/users/local is not a valid path
If it's under a specific user :
splunk/etc/users/username/appname/local/props.conf then navigate to the app... and then run your search and you should see your field.
Search Mode Selector to
Verbose Mode. First appearing in v5.0 (and restyled in v6.0) is a new
Search Mode Selector control that, depending on how you set it, will either show all the data available for your search (at the expense of speed), or speed up and streamline your search in certain ways (mainly by skipping all field extractions). The selector is at the upper right-hand corner just below the search button. The
Verbose modes represent the two ends of the search mode spectrum. The default
Smart mode switches between them depending on the type of search that you are running. Whenever you first run a saved search, it will run in Smart mode. Be aware that the
Search Mode Selector setting is part of your
viewstate and in that regard is somewhat "stateful" meaning that you my find it automatically reset to unexpected values as you navigate through different views.