Dashboards & Visualizations

Extracted fields are not shown in dashboards or scheduled reports

asnegina
New Member

I have some extracted fields and I do see them while searching. In smart mode I select interesting fields and hit "Save as report", everything is OK:
alt text

But when I schedule this report and it runs, my fields don't show up! I can see only _time left in this scheduled report:

alt text

And if I hit "Open in Search..." my extracted fields are here again.
Same thing when trying to save my search as s dashboard pane: no extracted fields, even if using "fields" command.
All permissions on extracted fields are Global: I checked twice. This is a demo instance, so I use only one user for creating fields and reports.
What am I missing? Any privacy settings?

0 Karma
1 Solution

peterchenadded
Path Finder

Can you please send through your query.

You might want to add

Your base search | table _time, ru_event_type, description, sender, atom

To see if it helps.

View solution in original post

0 Karma

peterchenadded
Path Finder

Can you please send through your query.

You might want to add

Your base search | table _time, ru_event_type, description, sender, atom

To see if it helps.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...