Same issue here. Even after "Apply Changes" still getting the warnings. I managed to fix it from Monitoring Console > General Setup > Edit > "Disable Monitoring", then "Enable Monitoring" for each search head and the deployer! (make sure to review the roles after you do this step).   ... View more

@somesoni2 No it means that that log file doesn't have that field. For, example the field transaction_id may be a non-nested key or it could be something like payload.response.transaction_id which is nested. I basically want to melt that into one column, but am having problems with null overwriting the current value. You suggested that I order the columns in increasing sparseness? (i.e. coalesce(4% sparse,20% sparse, 80% sparse)) ... View more