I have a view (xml) that contains a search. Then i am performing some postprocess and listing the results in a table. Some of the fields are showing up, and one particular one is not. I noticed that this field is a search time extracted field through a props.conf.
Here is a simplified look at my xml:
<searchPostProcess>| fields _time, host, source, sourcetype, CoreID, date_mday </searchPostProcess>
CoreID is a field that is being extracted during search time through a regex. (this shows in a regular search just fine, it just doesnt show in this particular view of mine).
If a field is not referenced in the main search, it is likely to be discarded from the results. This is a normal Splunk search optimization. However, since it's gone from the original search results, your postprocess will not be able to use it. You could add a fields command to the original to ensure it keeps any fields you really want later.