We downloaded and installed the Field Extractor App Version 1.6 with Splunk Enterprise 6.0. We have two issues with using the app. Issue 1: We used the app to extract 10 fields from a single log file. When the system was rebooted only 5 extractions are retained. We are on Splunk Enterprise version 6.0. Some of the rules that are defined in the app were saved while some rules were not saved after reboot. When the extraction is saved as a rule, they are reflected in the props.conf. Once the system is rebooted or when the data is re-indexed, the extractions are no longer listed when the search is initiated. Issue 2: If we select one particular field e.g. SUCCESS for extraction, it highlights the SUCEESS field but in addition it also highlights some additional non-related data. The issue here is that when we click the “X” button it does not deselect the non-related data. Thus the appropriate field cannot be extracted correctly. Thanks again. We love this App! ... View more