I have a simple search
index=myIndex sourcetype=mySourcetype
If I run the search in the Splunk Enterprise Security app I get src_ip
. If I run the search in a different app, I don't get src_ip. I need leads on how to figure out why this is happening. Any leads?
TIA,
Joe
Check Fields -> Extractions in the Splunk Enterprise Security App. There would be an EXTRACT written to extract such fields. You can add the same in your app or set the permissions of the existing EXTRACT to global to leverage the same behaviour across all apps.
Check Fields -> Extractions in the Splunk Enterprise Security App. There would be an EXTRACT written to extract such fields. You can add the same in your app or set the permissions of the existing EXTRACT to global to leverage the same behaviour across all apps.
It was a permissions issue on the extracts. They were set to app only. When I changed them to global the search in the other app started working.