Well, I have figured out a few things last night that helped me understand why things sometimes don't show.. writing it here for other newbies to reference. Thanks to everyone for responding, the answers definitely helped me eliminate things: The regex for an extracted field has to be perfect, or the field will not show. I started using an app that helps me write the extractions (search in the app area) and that helped out a lot. Using the cloud version is a bit tough because I didn't have access to the props.conf. When I installed locally, I could watch when files changed and understand where I should be putting different configuration stuff. Get the permissions correct, both on the field itself AND on the config files! For some reason, I would enter an extract field in teh GUI and no files were getting written... I changed the permissions at the OS level and it worked. The field will NOT show if the current set of data on the screen doesn't have it in the events. You must filter in search (by time or whatever) to get that event in the current area. Then the field shows. This goes for all fields, they are dynamic based on what data is up at the time, it doesn't just show all fields for your sourcetype all the time. A great quick tester for regex is notepad++ (I am sure there are others, but I already use that for other things). It is on the 'find' window, where you can enter your regex and search the file for it, verifying that works. ... View more