(search time) extracted field not showing up on the table

[Genti]

I have a view (xml) that contains a search. Then i am performing some postprocess and listing the results in a table. Some of the fields are showing up, and one particular one is not. I noticed that this field is a search time extracted field through a props.conf.

Here is a simplified look at my xml:
   <table>
      <title>Result</title>
            <searchPostProcess>| fields _time, host, source, sourcetype, CoreID, date_mday </searchPostProcess>
   </table>

CoreID is a field that is being extracted during search time through a regex. (this shows in a regular search just fine, it just doesnt show in this particular view of mine).

Cheers!

[Genti · Accepted solution]

Yeap.
Moreover, it is more efficient to do it that way as well. Here is the final version that actually works:

   <table>
      <title>Result</title>
      <fields>_time, host, source, sourcetype, CoreID, date_mday</fields>
            <searchPostProcess></searchPostProcess>
   </table>

If there are any other postprocess transformation that you wish to do you can continue to do them.

[gkanapathy]

If a field is not referenced in the main search, it is likely to be discarded from the results. This is a normal Splunk search optimization. However, since it's gone from the original search results, your postprocess will not be able to use it. You could add a fields command to the original to ensure it keeps any fields you really want later.