Hello,
When indexing data, I extract some selected fields. Thus, these fields are not part of 'EXTRACT-fields' line in props.conf, as it is suggested by documentation. Fields are indexed fine and I can search using the fields names. However, what does not work is extracting some of these fields from the search using the | fields command, like:
index=.. <search criteria> | fields gh
I do see these fields in Splunk Web, and for example | table gh works with the fields, but not the | fields which produces no results.
Puzzled. Is there a special syntax to refer to indexed fields in the fields filter?
Thanks
Andrei
