Why don't Windows event fields appear in search result?

[esafaei]

Hi all,

Recently I've upgraded all splunk deployment tiers (search head, Indexer and Heavy Forwarder) and we are collecting Windows event by Splunk_TA_windows add-on.

Before the upgrade, Windows event fields like EventCode was appearing but after the upgrade only general fields is visible.

The Splunk_TA_windows add-on installed on all components of splunk (HF, SH and indexer)

Despite not appearing the fields, I can use missing fields like EventCode in search query and commands like top and stats.

How can I troubleshoot and resolve the problem? What's wrong? Anybody can help me?

[gcusello · Accepted solution]

Hi @esafaei,

a very stupid question: did you used the Verbose Mode in Search?

Ciao.

Giuseppe

[esafaei]

OMG! 
😂😅😬