Got it. I see it's working now. The magic was created by an "Automatic Lookup". It's hidden in the settings and I never knew it was enriching the search results silently. Thanks for sharing multiple helpful "what it could be" @PickleRick @gcusello and also helping with the exact solution. ... View more

The expanded events do not have the  "Environment" field but the Interesting field has the environment field. I checked the extracted fields and could not find the Environment field being extracted. So, my question is how would Splunk get to know the field name "Environment" and its value. Also whatever value is getting populated for "Environment" field is not present in the event. So, how this can happen? Could this be happening via Index somehow?  ... View more

I checked all three settings for fields but did not see setting related to the fields I am seeing in interesting fields. Is there any other way to enrich the search results in the background by some another process? ... View more

Thanks for your response. I read in the documentation fschange was deprecated in the version 5 and I am using Splunk Enterprise version 8.1.5. Can you please suggest an alternate solution? I'd appreciate your help. ... View more