Hello - I created a Field Extraction to look for a file extension. The raw log looks like this: "FileName": "John Test File.docx" The regex I used was: "FileName":\s".+\.(?P<Domain>.[a-zA-Z0-9]*) This tests out in any regex tester I use. When I first created this, I ran a search query and some of the fields populated, but some were blank. I then checked which records weren't being extracted correctly, and found the regex matched the raw log pattern, so I was unsure why it wouldn't have extracted. However, ~30 minutes after creating this field extraction. It stopped extracting anything. The state I'm now, I can see that each raw log record matches my extraction regex, but the fields are still empty and this isn't being extracted. Why would that be? Each raw log matches the regex in the extraction...
... View more