Configured Field is not showing in interesting field.
Getting ;;;;;;;;;;;;; value after searching with index="Index Name " sourcetype=*
Hi gcusello,
When I tried to search with long timestamp then value is showing, but its format is not correct, also value is in encrypted format, Should I check configuration at application end as well.
index="Index Name" sourcetype=* your_field=*
Hi gcusello,
When I tried to search with long timestamp then value is showing, but its format is not correct, also value is in encrypted format, Should I check configuration at application end as well.
index="Index Name" sourcetype=* your_field=*
Hi @gcusello ,
Thanks for the response,
I have already checked with the mentioned command, but there is no output, However I am getting the test results for other configured fields.
Hi @AA_01,
if you have no results adding your_field=* to the main search, this means that the field isn't correctly configured, check the permissions ad eventually try to extract it again.
Did you checked also the Verbose Mode?
Ciao.
Giuseppe
Hi @AA_01,
two checks to perform:
did you checked that you're using the Verbose Mode and not the Fast or the Smart Mode?
if you add to your search the filter "your_file=*", do you see the field in interesting fields?
index="Index Name" sourcetype=* your_field=*
if there are less than 2% of events, a field isn't visualized in Interesting fields.
Ciao.
Giuseppe