Splunk Enterprise Security

Field Extraction not working in ES App

sumanssah
Communicator

Hello Experts,

I am facing difficulty while performing a search on ES App. While performing a search in ES App filed extraction is not working and the same search is showing alert all other apps. I checked for app permission and is set to Global for all apps.

Please help me with possible troubleshooting. Thanks in advance.

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

If you are running ES 5.2 or lower and your field extractions is defined outside ES app then you need to import app/add-ons which has field extraction defined in ES. Have a look at https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#App_and_add-on_import_naming...

View solution in original post

harsmarvania57
Ultra Champion

Hi,

If you are running ES 5.2 or lower and your field extractions is defined outside ES app then you need to import app/add-ons which has field extraction defined in ES. Have a look at https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#App_and_add-on_import_naming...

sumanssah
Communicator

Thanks @harsmarvania57

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...