I'm not sure how to do that. Let me figure this out how to search in dashboard panel. I'm new to Splunk still learning.  ... View more

Yes, I tried fetching for only 1 day instead of 7 days but still the same issue. After clicking on "Create Table View" those fields are disappearing.  ... View more

index="aws" earliest=-7d@d latest=@d | search "Method request" "systemId" | rex field=_raw "\((?<messageId>[^)]+)\)[^:]+:\s*\{(?<messageFields>.*)\}" | rex field=messageFields "Id=(?<systemId>[^,]+)" | rex field=messageFields "product=(?<product>[^,]+(?:,[^,]+)*)(?=, systemId=)" | rex field=_raw "Field=\"(?<eventFieldName>[^\"]+)\"" | rex field=_raw "FieldValue=\"(?<eventFieldValue>[^\"]+)\"" | rex field=_raw "type=\"(?<eventType>[^\"]+)\"" | search product="O,U" systemId!="0454c7f5" | dedup messageId | join type=left messageId [ | from datamodel:"getStatusCodes" | fields messageId, statusCode ] | join type=left systemId [ | from datamodel:"verifyCalls" | rename siteCoreId as systemId | eval Verified="Yes" | fields systemId, Verified ] | eval Verified=coalesce(Verified, "No") | table _time, messageId, systemId, statusCode, Verified | sort - _time | head 10000 Above is the Splunk Query.  When I search this query I get these fields in the output (_time, messageId, systemId, statusCode, Verified) but when I click on "Create Table View" only (_time, messageId, statusCode) fields are coming. ... View more