https://community.splunk.com/t5/Splunk-Search/CEF-Field-Parsing/m-p/462511#M140549 <P>I am not seeing extracted field against below query.</P> <P>index=fireeye | eval {flexString2Label} = flexString2</P> <P>below are crossponding values in CEF format<BR />flexString2Label = subjcect</P> <P>flexString2 = "a test message"</P> <P>Please advise that what I a missing</P> Mon, 08 Jun 2020 22:04:09 GMT riqbal47010 2020-06-08T22:04:09Z https://community.splunk.com/t5/Splunk-Search/CEF-Field-Parsing/m-p/462511#M140549 <P>I am not seeing extracted field against below query.</P> <P>index=fireeye | eval {flexString2Label} = flexString2</P> <P>below are crossponding values in CEF format<BR />flexString2Label = subjcect</P> <P>flexString2 = "a test message"</P> <P>Please advise that what I a missing</P> Mon, 08 Jun 2020 22:04:09 GMT https://community.splunk.com/t5/Splunk-Search/CEF-Field-Parsing/m-p/462511#M140549 riqbal47010 2020-06-08T22:04:09Z https://community.splunk.com/t5/Splunk-Search/CEF-Field-Parsing/m-p/462512#M140550 <PRE><CODE>| makeresults | eval flexString2Label = "subject",flexString2 = "a test message" | eval {flexString2Label} = flexString2 </CODE></PRE> <P>this is OK.<BR /> maybe, <CODE>flexString2Label</CODE> OR <CODE>flexString2</CODE> field does not extracted.</P> Wed, 01 Apr 2020 12:49:42 GMT https://community.splunk.com/t5/Splunk-Search/CEF-Field-Parsing/m-p/462512#M140550 to4kawa 2020-04-01T12:49:42Z