Adding a new indexed meta field to inputs.conf not showing up in fastmode

[brent_weaver]

We see it in smart mode but not in fast mode. What are we missing and where does this get defined?

[Sukisen1981]

if you can see it in both search and verbose mode, then one check that I suggest in do you know for sure that the custom meta field (i am assuming this is indexed filed and not a default field) occurs for greater than 20% of the events? To test you can change your inputs.conf and slightly re-configure the meta field to have it display for all fields like for source or sourcetype.

[Sukisen1981]

@brent_weaver
https://docs.splunk.com/Documentation/SplunkCloud/7.0.3/Knowledge/Aboutfields