@shakeeI253 - You need to be MUCH more specific. An "extract" can be anything from a mainframe COBOL/MVS job to an Oracle procedure to a splunk search to god knows what.
Are you talking about Tableau extract refresh schedules? If so, are the extract schedules run and managed on Tableau Online (from cloud sources), or using Tableau Bridge (from on premises sources)? IF on premises, are they coming via the SDK from Unix, Windows, Mac?
Splunk can report on any event that it has received and ingested... but you have to find the events. What I would suggest is to figure out an exact time that one certain extract ran and completed, and then search splunk to see if the data about the search was loaded.
Start with something like this...
index=*
earliest=2m before the extract started
latest=5m after the extract finished
First check the list of indexes you got data back from. In my shop, Tableau would have its own index, so would Informatica, and any similar products. If you find the index, you are golden. If not, then there is more hunting to do.
Second, if there is no index that looks promising, add "tableau" to the search and see if you get a useful subset of data. If not, then there is more hunting to do.
Poke around in the data. Kill any indexes that you know will not get tableau events. In mixed indexes, kill all the most common types of events, a few types at a time, to see what is left.
If nothing promising emerges, then find out the name of the host that your target extract runs on, widen your search time slightly, and add the host to the search
index=*
earliest=5m before the extract started
latest=15m after the extract finished
("your hostname" OR "1.1.1.1<-yourhost'sIP")
Once you find the events, then we can help you turn the raw events into a decent report.
... View more