For my particular use case, I want to compare the difference between the count of fields extracted in windows event logs before versus after I install the Splunk TA for Windows on my search head.  It fits my use case, but it might not for others if you have inconsistent configurations across your search head peers, for example. ... View more

That is how it is supposed to work. The summary part means just that. It only saves the fields that are present in your final results and even then, some, like host are overridden and moved to orig_* values like orig_host . If you need the fields then you must preserver then through to the end of your search results. ... View more