Thanks for everyones help. I SUSPECT the field I am looking for does not show up because this particular log [ out of the 10 in our index] is generated from Weblogic and the pretrained "source type" = access_common so it cannot see it. I ended up selecting a record , selected the EVENT ACTIONS pulldown and selected "Extract Fields". Using this tool it generated me a regex of rex "(?i)^(?:[^\t]*\t){9}(?P[^\t]+)" An real example follows.
index=YourIndex sourcetype="access_common" | head 100 | rex "(?i)^(?:[^\t]*\t){9}(?P[^\t]+)" | top 50 FIELDNAME
Obviously I was looking for IP addresses. In our case we had Weblogic write the cookie containing this IP info to the log.
... View more