I am facing issues with the use of extracted fields.
I intend to create a timechart with the extracted values. I have created new field on the field extraction page and gave the right permissions. Still the field is not showing up in the list of interesting fields on the search page. Is there any additional step that I am missing?
I do not have access to props.conf file.
Please suggest the way forward. Any help is much appreciated.
I am facing same problem, I am able to see the field in settings> fields > extracted fields. but not under interested fields, I have selected the correct sourcetype but still am unable to see the extracted field under interested fields.
The extracted field is relative to the sourcetype that you chose when extracting that field. So make sure you have the correct sourcetype then flip your search mode in
smart or verbose mode then you should see it. You can also select "all Fields" and find your new field and check the box and it will show in your 'Selected Fields' section
Check you search mode. Interesting fields do not display in Fast mode. Should be Smart or Verbose. Interesting fields show up only if more than 20% of the events have that field. Try using it in a command. Something like
stats count by field