Native fields not visible (Real-Time Output App)

[jonathan_cooper]

Using the output assistant, and configuring the base of my search (i.e. sourcetype="wineventlog:security"), I see results showing up in CEF format but the "Splunk Fields" section is always blank. I tried in both IE and FireFox just to ensure it wasn't a browser rendering issue. Any ideas or is it still possible to use fields that I know exist? The drag and drop portion is not working because of this.

I've been able to glean the following search terms to modify the CEF output:

.. | eval cef_override_map="host:dvchost"
.. | eval cef_static_map="cef_dvendor:Microsoft"

Are there any others? Do you happen to have a README on these? I'm fine bypassing the output assistant if I can get an understanding of how the searches work to convert the outputs to CEF. Thanks!

[bkilroe · Accepted solution]

I managed to get it working by looking at the python scripts. You need to use cef_field_map rather than cef_override_map

index=_internal source="*web_access.log" | eval cef_field_map="host:dvchost,source:fname,spent:cn1,useragent:cs1,user:duser,status:cn2,clientip:dvc,method:cs2,bytes:cn3"