Why do I get the following error message when I try to extract new fields?
The events associated with this job have no sourcetype information: 1524125445.48
please see this answer:
in general, you have to assign sourcetype at input time in order to apply search time extraction (and other functions) on your data
hope it helps
View solution in original post