We setup a search peer in a master/slave scenario and noticed that not all of our fields are present in the search peer (slave) that are present in the master index.
Any idea why I can see the IIS fields in the master index, but not the search peer? We are just trying to do something basic like this (sourcetype is iis😞
index=iis cs_method=POST
The problem is that I cannot see the cs_method field or its alias method - the only fields we see are local custom extracted fields (defined field extractions). Is this the expected behavior? Are we supposed to define all the fields we want to extract and use those instead of the interpreted fields? This could just be my lack of understanding of the index/field creation. Why isn't splunk automatically extracting the IIS fields for me on the remote peer?
Note: If I create a local field extraction it works fine. It seems the search peer isn't handling the automatic field extraction for the IIS sourcetype properly.
Could this be related to IIS auto header extraction failing?
