I finally figured this out - I had edited the original post to use the REPORT thing. This actually worked, I just did not realise it - my two tests for looking for field names were bad tests - they did not show any field names even though there were now extracted field names! This is pretty bizzare, and in my opinion, there should be something in the search GUI that can show all field names - maybe there is a way and I don't see it? But oh well, but maybe I'll get used to it. Part of what threw me is that I thought "View All 7 Fields" referred to all fields in existence, but no - it only refers to fields THAT ARE VISIBLE in the search results and you have to MAKE FIELDS VISIBLE MANUALLY. So you get into a chicken-and-egg situation where the fields you are interested in are not listed because you have not made them visible and you can't make them visible because they are not listed! I'd love to know of a good solution to this - I've found a crude hack below. The best tests I can find now are: It used to show "Field discovery is: On" but now that the field name extraction is working, it shows "Field discovery is: Off" If I search for a field name that I know I specified in the transform.conf, it lists results, and then I can add that to my selected/visible fields. But for numerous fields, this is a hassle. E.g. Colour=Blue From here I discovered you can do a search that lists all field names, and then you can make all of them selected visible more easily. E.g. sourcetype="My Source Type 1" | stats dc(*) as * I hope that helps someone. ... View more