We are having some odd search results. When the query is ran in Verbose mode all fields return as expected, however when the same query is ran in Smart or Fast mode only the default fields are returned and the two fields extracted at search time via the "| rex" command. Anyone run into this before? EDIT Query used: (index=foo sourcetype=bar) OR (index=metrics sourcetype=stats [ search index=foo sourcetype=bar | mvexpand combine | rex field=combine (?<id>\d+)=(?<hits>\d+) | dedup id site | fields id site] earliest=-1y) | fillnull combine | mvexpand combine | rex field=combine (?<id>\d+)=(?<hits>\d+) | eventstats latest(ip) as IP latest(info_id) as Info_ID by id, site | where isnotnull(hits) | table _time hits id site IP Info_ID When my search runs in Verbose mode I see all fields "_time hits id site IP Info_ID" However when I run it in Fast mode I am missing IP and Info_ID. If I remove the "| table" section altogether and run it in fast mode the query runs and all interesting fields are populated on the left side of the events. ... View more

This works if you | rex "EXTRACT-json_data=.+\"(?<json_data>{.+})\"" But when I try to move it over to props.conf as: [mysourcetype] EXTRACT-json_data=.+"(?<json_data>{.+}) It doesn't work. Any ideas on what I'm doing wrong? Thanks! -Joe ... View more

We are replacing (upgrading to new hardware) an indexer that is part of an indexer cluster. In the cluster there are two indexers with replication factor of 2 and search factor of 2. When the new indexer is online and joined to the cluster, will the indexes and all associated historical buckets be auto-magically copied over? Thanks! -Joe ... View more