https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-there-Splunk-warning-message-indexer-name-field-does-not/m-p/653402#M53718 <P>Hi All,<BR />we are on Splunk cloud. On one of our dashboard panels,&nbsp; I am getting a warning message: <STRONG>[idx-xxxx field 'technique_id' does not exist in the data]&nbsp;</STRONG><BR />Interestingly this wasn't the case until last week.&nbsp; Pls see below screenshots.&nbsp; The search runs by default in Fast mode as its a dashboard query. It populates data in a panel.&nbsp; While troubleshooting, if&nbsp; i run it manually in verbose mode, the field <STRONG>technique_id</STRONG> exists under "Interesting fields".&nbsp; Why is fast mode throwing that warning and how to get rid of it?&nbsp; &nbsp;Is this an indexing issue with one of those indexers?<BR /><BR /></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="neerajs_81_0-1691408218203.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/26656iFC9BAB501895B6C9/image-size/medium?v=v2&amp;px=400" role="button" title="neerajs_81_0-1691408218203.png" alt="neerajs_81_0-1691408218203.png" /></span></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="neerajs_81_1-1691408369515.png" style="width: 498px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/26657i9CAA8F1A9CAB79C4/image-dimensions/498x437?v=v2" width="498" height="437" role="button" title="neerajs_81_1-1691408369515.png" alt="neerajs_81_1-1691408369515.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 07 Aug 2023 19:24:27 GMT neerajs_81 2023-08-07T19:24:27Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-there-Splunk-warning-message-indexer-name-field-does-not/m-p/653402#M53718 <P>Hi All,<BR />we are on Splunk cloud. On one of our dashboard panels,&nbsp; I am getting a warning message: <STRONG>[idx-xxxx field 'technique_id' does not exist in the data]&nbsp;</STRONG><BR />Interestingly this wasn't the case until last week.&nbsp; Pls see below screenshots.&nbsp; The search runs by default in Fast mode as its a dashboard query. It populates data in a panel.&nbsp; While troubleshooting, if&nbsp; i run it manually in verbose mode, the field <STRONG>technique_id</STRONG> exists under "Interesting fields".&nbsp; Why is fast mode throwing that warning and how to get rid of it?&nbsp; &nbsp;Is this an indexing issue with one of those indexers?<BR /><BR /></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="neerajs_81_0-1691408218203.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/26656iFC9BAB501895B6C9/image-size/medium?v=v2&amp;px=400" role="button" title="neerajs_81_0-1691408218203.png" alt="neerajs_81_0-1691408218203.png" /></span></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="neerajs_81_1-1691408369515.png" style="width: 498px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/26657i9CAA8F1A9CAB79C4/image-dimensions/498x437?v=v2" width="498" height="437" role="button" title="neerajs_81_1-1691408369515.png" alt="neerajs_81_1-1691408369515.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 07 Aug 2023 19:24:27 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-there-Splunk-warning-message-indexer-name-field-does-not/m-p/653402#M53718 neerajs_81 2023-08-07T19:24:27Z