When I am doing export search using java sdk, I am missing columns when I running this query. search sourcetype=sourcetype_1 OR (sourcetype=sourcetype_2 NOT (Session_Duration="Session Duration"))|rex field=sourcetype "(? [^\W]+)(? [^_\W]+)" |eval client_ip_address = Client_Address|eval Document_Session_Duration = Session_Duration| eval Message=replace(Message, ",","-")| eval Document=replace(Document, ",","-")| iplocation client_ip_address|table Timestamp,User,Document,Message,Document_Session_Duration,server_type, source_log_type, host, client_ip_address, City, Country what gives ? I am using splunk 6.1.1 ... View more