All Apps and Add-ons

Fields only parsing in the Windows DHCP App

Ronvgraham
Engager

I would like to have the DHCP records parsed in the main search app the same as they are in the Windows DHCP app. I have attempted to move the files from the default and lookup folder to the /etc/local folder in the search app. Unfortunately, it does not appear to be parsing the fields from the logs in the same manner as the DHCP app.

Is there instructions on what I need to do to get the fields to parse correctly in the Search & Reporting app so I can match the logs to other sources?

Tags (1)
0 Karma
1 Solution

okrabbe_splunk
Splunk Employee
Splunk Employee

Go to settings -> fields -> field extractions.

Find your field extraction in the list. You will then see a move link under actions and you can move the extractions to the search app.

Your other option would be to make the field global. You can do this from the same list by clicking on "permissions" and saying that the object should appear in all apps.

This is a common question. You can see another example response at this link :
http://answers.splunk.com/answers/86/how-do-i-share-all-of-the-field-extractions-defined-in-a-given-...

View solution in original post

0 Karma

Ronvgraham
Engager

I did not have the move link in the version of Splunk I am currently running 6.0. The permissions did fix the problem though. Thank you very much for your help

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Go to settings -> fields -> field extractions.

Find your field extraction in the list. You will then see a move link under actions and you can move the extractions to the search app.

Your other option would be to make the field global. You can do this from the same list by clicking on "permissions" and saying that the object should appear in all apps.

This is a common question. You can see another example response at this link :
http://answers.splunk.com/answers/86/how-do-i-share-all-of-the-field-extractions-defined-in-a-given-...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...