We are having an issue getting fields to work with this one application. If we move the props.conf to the etc/system/local/ directory the extractions work fine but when they are in a seperate app they are not working. We have also verified when using the same regex in the search everything works fine: earliest=-5m index=pcoip |rex field=_raw "(?i)(ms) = (?P
We have verified permissions are set to Everyone Read and Admin Write for the app as well. We are using 4.5.2.4. This has been driving us crazy for several days.
props.conf file:
[vmware_pcoip]
EXTRACT-rtt = (?i)(ms) = (?P
EXTRACT-rloss = (?i) Loss=(?P
EXTRACT-tbl = (?i) tbl (?P
EXTRACT-tloss = (?i)^[^%]*%/(?P
Are you trying to use the fields in a different app, e.g. search?
They are probably set to App level sharing, instead of Global, if so. Check via Manager -> Fields -> Field Extractions, then the permissions link next to the extractions.
Thanks, that worked.