https://community.splunk.com/t5/Splunk-Search/What-s-causing-the-error-message-in-the-extraction-of-new-fields/m-p/341907#M101303 <P>hello there,</P> <P>please see this answer:<BR /> <A href="https://answers.splunk.com/answers/578392/field-extraction-issue-on-events-with-no-sourcetyp.html">https://answers.splunk.com/answers/578392/field-extraction-issue-on-events-with-no-sourcetyp.html</A><BR /> in general, you have to assign sourcetype at input time in order to apply search time extraction (and other functions) on your data</P> <P>hope it helps</P> Thu, 19 Apr 2018 19:00:53 GMT adonio 2018-04-19T19:00:53Z https://community.splunk.com/t5/Splunk-Search/What-s-causing-the-error-message-in-the-extraction-of-new-fields/m-p/341906#M101302 <P>Why do I get the following error message when I try to extract new fields?</P> <P>The events associated with this job have no sourcetype information: 1524125445.48</P> Thu, 19 Apr 2018 08:15:51 GMT https://community.splunk.com/t5/Splunk-Search/What-s-causing-the-error-message-in-the-extraction-of-new-fields/m-p/341906#M101302 atemourt 2018-04-19T08:15:51Z https://community.splunk.com/t5/Splunk-Search/What-s-causing-the-error-message-in-the-extraction-of-new-fields/m-p/341907#M101303 <P>hello there,</P> <P>please see this answer:<BR /> <A href="https://answers.splunk.com/answers/578392/field-extraction-issue-on-events-with-no-sourcetyp.html">https://answers.splunk.com/answers/578392/field-extraction-issue-on-events-with-no-sourcetyp.html</A><BR /> in general, you have to assign sourcetype at input time in order to apply search time extraction (and other functions) on your data</P> <P>hope it helps</P> Thu, 19 Apr 2018 19:00:53 GMT https://community.splunk.com/t5/Splunk-Search/What-s-causing-the-error-message-in-the-extraction-of-new-fields/m-p/341907#M101303 adonio 2018-04-19T19:00:53Z