Dashboards & Visualizations

Extracted fields are not shown in dashboards or scheduled reports

asnegina
New Member

I have some extracted fields and I do see them while searching. In smart mode I select interesting fields and hit "Save as report", everything is OK:
alt text

But when I schedule this report and it runs, my fields don't show up! I can see only _time left in this scheduled report:

alt text

And if I hit "Open in Search..." my extracted fields are here again.
Same thing when trying to save my search as s dashboard pane: no extracted fields, even if using "fields" command.
All permissions on extracted fields are Global: I checked twice. This is a demo instance, so I use only one user for creating fields and reports.
What am I missing? Any privacy settings?

0 Karma
1 Solution

peterchenadded
Path Finder

Can you please send through your query.

You might want to add

Your base search | table _time, ru_event_type, description, sender, atom

To see if it helps.

View solution in original post

0 Karma

peterchenadded
Path Finder

Can you please send through your query.

You might want to add

Your base search | table _time, ru_event_type, description, sender, atom

To see if it helps.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...