I have a view (xml) that contains a search. Then i am performing some postprocess and listing the results in a table. Some of the fields are showing up, and one particular one is not. I noticed that this field is a search time extracted field through a props.conf.
Here is a simplified look at my xml: <table> <title>Result</title> <searchPostProcess>| fields _time, host, source, sourcetype, CoreID, date_mday </searchPostProcess> </table>
CoreID is a field that is being extracted during search time through a regex. (this shows in a regular search just fine, it just doesnt show in this particular view of mine).
Cheers!
Yeap.
Moreover, it is more efficient to do it that way as well.
Here is the final version that actually works:
<table> <title>Result</title> <fields>_time, host, source, sourcetype, CoreID, date_mday</fields> <searchPostProcess></searchPostProcess> </table>
If there are any other postprocess transformation that you wish to do you can continue to do them.
Yeap.
Moreover, it is more efficient to do it that way as well.
Here is the final version that actually works:
<table> <title>Result</title> <fields>_time, host, source, sourcetype, CoreID, date_mday</fields> <searchPostProcess></searchPostProcess> </table>
If there are any other postprocess transformation that you wish to do you can continue to do them.
If a field is not referenced in the main search, it is likely to be discarded from the results. This is a normal Splunk search optimization. However, since it's gone from the original search results, your postprocess will not be able to use it. You could add a fields
command to the original to ensure it keeps any fields you really want later.