Search is not listing the Extracted field

[bshamsian]

I am having problems with an extracted field not showing in the search results. I am indexing a log file that among many things it contains the size of certain Queue. The size is outputted in the log in the following format(example):

07/11/12 06:04:30 PM INFO com.foobar.recorderResource handle - 10 events currently in queue.

In the search window I used the following query to extract the field:

host=abc | rex "recorderResource handle - (?P\d+) events currently in queue" | search queueSize="*"

This works great and I see the values. I then created a new extracted field based on the regex pattern I used above as such:

host::abc : EXTRACT-queueSize Inline recorderResource handle - (?P\d+) events currently in queue

However when I do a search for

host=abc

the queueSize extracted field does not show up anywhere - It is not in the 'Selected Fields' section of the leftnav or the 'Suggested Fields' or in the Field Picker popup. I thought it might be because it is in less than %1 of the result so I switched the search string to

host=abc events currently in queue

which would only show results that have the queue size in them and the extracted field still does not show up anywhere. Can anyone suggest what I am doing wrong?

All help is greatly appreciated.

[kenth]

Add to your transforms.conf;

[queueExtract]
REGEX = recorderResource handle - (\d+) events currently in queue
FORMAT = queuesize::$1

and to your props.conf

[host::abc]
REPORT-queueExtract = queueExtract

Should work, but only on that specific host though so I might add it under a sourcetype or source if you've got that.