Why are new field extractions not showing up in search (verbose mode)?

[corehan]

Hello dears,

I deleted my custom field which I created before but still extract in search results. Also, I'm trying a new field extract ( sampling is fine ) but it doesn't show in search ( verbose mode ).  Do you have any idea, why?

Regards.

[VatsalJagani]

Make sure you are running the search query from the same App in which you created/changed the extraction.

Try running this search:

<your search query> | extract reload=T

(If you have not restarted the Splunk this will reload the props configuration changes)

If you still do not see changes, run the below command from the backend to see if Splunk got new changes. (There could be a possibility that your changes are in the file which has lower precedence.)

.splunk show config props

 
I hope this helps!!

[corehan]

Hi,

 - search | extract reload : didn't work

- Server restart : didn't work

- splunk show config props : I didn't try, i'm waiting for admin return because is enterprise product.

Thank you for suggests

Regards.