This is a known limitation of CHECK_FOR_HEADER in a distributed environment.
From props.conf.spec :
CHECK_FOR_HEADER = [true|false]
* Used for index-time field extractions only.
(...)
* The field names are stored in etc/apps/learned/local/props.conf.
* Because of this, this feature will not work in most environments where the data is forwarded.
In your case, CHECK_FOR_HEADER writes the header-based field extractions in the learned app of the forwarder, information which is of course not available when you search from the indexer.
Of the two work-arounds discussed here, my preference goes to ftk's (the second one listed) :
1 - Ingest a couple of files on the indexer to create the field extractions there for sourcetypes iis and iis-2 at the minimum.
2 - Disable CHECK_FOR_HEADER on the forwarder for this sourcetype, clean up the learned app and configure the delimiter-based field extraction manually in transforms.conf on the indexer or search-head.
... View more
