tstats isn't displaying search

[rtalcik]

| tstats count where index=proxy AND sourcetype=dns earliest=-7d by _time, ComputerName span=1h
| xyseries _time, ComputerName, count

So this is an actual field with an actual value and it isnt loading into the search, any reason why?

[richgalloway]

All fields used by tstats must be indexed. Are you sure ComputerName is extracted at index-time and not at search-time?

[rtalcik]

Its a custom made field. So probably at search time.... is there a way around this

[rtalcik]

or a way to find out

[richgalloway]

| walklex type=field index=* | stats values(field) by index will list all of your indexed fields.