I have a search head cluster (splunk 6.2) with two search head members (1 captain,1 search head,1 deployer) and one indexer. I created a field extraction on search head and it has the config in props.conf, but the field extraction is not showing in search head immediately. It takes 2-3 days to show the field extraction. I want to know how to solve this problem. Steps to Reproduce: 1. I config search head cluster by http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/SHCdeploymentoverview 2. Input data on indexer (search peer) 3. Create a field extraction on search head. 4.Run .../debug/refresh or restart service on search head ... View more

i'm using UF6 and I want to filter out or send to a null queue uninteresting Windows events with UF6. ... View more