Hi,
I am using below query. I am getting data but in chart i am getting warning '[tpl10082inf63] Field 'total' does not exist in data'
index=systest sourcetype=vmreport
| rex max_match=1000 "\Name\s\s\s\s\s\s\s:\s\s(?.)<\/TD>\Guest"
| rex max_match=1000 "\Guest\s\s\s\s\s\s:\s\s(?.)<\/TD>\State"
| rex max_match=1000 "\State\s\s\s\s\s\s:\s\s(?.*)<\/TD>\
We do not see the query referring to a field "total".
So maybe is it something coming from a different place ( automatic field extractions, automatic lookups, role search filter ...) ?
@sachinbansal
Can you please share sample event?