Issue with "Create Table View"

[bipul]

I've written a Splunk Query and ran it, it's giving the result as expected but as soon as I click on "Create Table View" some of the field disappears which were earlier coming post the query run. Not sure what is wrong, could anyone help?

[ITWhisperer]

Can you be a bit more specific? Which fields have "disappeared"? What does your SPL look like?

[bipul]

index="aws" earliest=-7d@d latest=@d
| search "Method request" "systemId"
| rex field=_raw "\((?<messageId>[^)]+)\)[^:]+:\s*\{(?<messageFields>.*)\}"
| rex field=messageFields "Id=(?<systemId>[^,]+)"
| rex field=messageFields "product=(?<product>[^,]+(?:,[^,]+)*)(?=, systemId=)"
| rex field=_raw "Field=\"(?<eventFieldName>[^\"]+)\""
| rex field=_raw "FieldValue=\"(?<eventFieldValue>[^\"]+)\""
| rex field=_raw "type=\"(?<eventType>[^\"]+)\""
| search product="O,U" systemId!="0454c7f5"
| dedup messageId
| join type=left messageId [ | from datamodel:"getStatusCodes" | fields messageId, statusCode ]
| join type=left systemId [ | from datamodel:"verifyCalls" | rename siteCoreId as systemId | eval Verified="Yes" | fields systemId, Verified ]
| eval Verified=coalesce(Verified, "No")
| table _time, messageId, systemId, statusCode, Verified
| sort - _time
| head 10000

Above is the Splunk Query.  When I search this query I get these fields in the output (_time, messageId, systemId, statusCode, Verified) but when I click on "Create Table View" only (_time, messageId, statusCode) fields are coming.

[ITWhisperer]

Since you are using joins, you could be hitting limits on the subsearches - have you tried a shorter timeframe?

[bipul]

Yes, I tried fetching for only 1 day instead of 7 days but still the same issue. After clicking on "Create Table View" those fields are disappearing. 

[ITWhisperer]

Why not use your search in a dashboard panel table?

[bipul]

I'm not sure how to do that. Let me figure this out how to search in dashboard panel. I'm new to Splunk still learning.