Why is configured Field not showing in interesting field?

[AA_01]

Configured Field is not showing in interesting field.

Getting ;;;;;;;;;;;;; value after searching with index="Index Name " sourcetype=*

[AA_01 · Accepted solution]

Hi gcusello,

When I tried to search with long timestamp then value is showing, but its format is not correct, also value is in encrypted format, Should I check configuration at application end as well.

index="Index Name" sourcetype=* your_field=*

[gcusello]

Hi @AA_01 ,

ok, let me know if you need more help.

Ciao.

Giuseppe

[AA_01]

Hi @gcusello ,

Thanks for the response, 

I have already checked with the mentioned command, but there is no output, However I am getting the test results for other configured fields.

[gcusello]

Hi @AA_01,

if you have no results adding your_field=* to the main search, this means that the field isn't correctly configured, check the permissions ad eventually try to extract it again.

Did you checked also the Verbose Mode?

Ciao.

Giuseppe

[gcusello]

Hi @AA_01,

two checks to perform:

did you checked that you're using the Verbose Mode and not the Fast or the Smart Mode?

if you add to your search the filter "your_file=*", do you see the field in interesting fields?

index="Index Name" sourcetype=* your_field=*

if there are less than 2% of events, a field isn't visualized in Interesting fields.

Ciao.

Giuseppe