I have some extracted fields and I do see them while searching. In smart mode I select interesting fields and hit "Save as report", everything is OK:
But when I schedule this report and it runs, my fields don't show up! I can see only _time left in this scheduled report:
And if I hit "Open in Search..." my extracted fields are here again.
Same thing when trying to save my search as s dashboard pane: no extracted fields, even if using "fields" command.
All permissions on extracted fields are Global: I checked twice. This is a demo instance, so I use only one user for creating fields and reports.
What am I missing? Any privacy settings?
Can you please send through your query.
You might want to add
Your base search | table _time, ru_event_type, description, sender, atom
To see if it helps.
Can you please send through your query.
You might want to add
Your base search | table _time, ru_event_type, description, sender, atom
To see if it helps.