Report is missing first column of data

[baegoon]

I have three reports that are based on transactions. The transactions are similar they report different process states. One of my reports does not show the first column of data. For instance I have "HelpdeskAgent", "RequestType", "Request Last Name", "Request Firstname", Request ID, Request Duration all in a table and the Helpdeskagent does not have the information in the column. I can run the report or goto the dashboard for the search in my search head and the HelpDeskAgent column is there and all three reports work. If I run the report manually all the columns populate. However when I export to PDF the column is missing for that report. This happens for the automated PDF export report as well. I don't thin it's a search term issue. However it could be a formatting issue??
Should I submit a support ticket for this?

Here is the search:

eventtype=IDMlogs  workflowstatus="Workflow_Started" OR workflowstatus="Workflow_Ended" OR workflowstatus="Workflow_Error" OR workflowstatus="User_Message" 
| transaction processid startswith=eval(workflowstatus="Workflow_Started") endswith=eval(workflowstatus="Workflow_Ended")
| eval duration = tostring(duration,"duration")
| sort -duration
| table helpdeskagent employeeType workforceID workforceIDGen surname givenName duration
| rename duration as "Time in Process", helpdeskagent as " Agent Assigned", surname as "Requestor Last Name", givenName as "Requestor First Name"

[woodcock]

It doesn't matter what the search is: if it generates a table and those tabular results are different when you export as PDF, you need to open a support case.

[baegoon]

Thanks! I will open one now.

[DalJeanis]

I notice that you have three different capitalizations for helpdeskagent in your question. Splunk is always case-sensitive for field names.

To start with, go back and make sure that you have spelled and capitalized the word exactly the way it is in the data.

Once you have verified that, we can try other debug methods.

[baegoon]

In my intro to the problem please treat that as Agent Assigned t. But please look at the search rather than my intro of the problem in regards to renaming helpdeskagent. This is why I included the search. Also helpdeskagent is a rex that was created using erex.