I've issue on 7.2.4.x where fields are not showing in the fast and smart mode , whereas works in verbose mode.I've explicitly declared the fields that i would like to display in fast and smart mode searches too . Fields are working fine in all modes in 7.0.x. All fields which are not displaying are calculated fields and field aliases .Please suggest to handle this issue.
-
(index=yc_idx sourcetype="my_sourcetype" Field1=* Field2=* ) |
stats count by Field1 ,Field2
index=yc_idx sourcetype="my_sourcetype" |fields + Field1 ,Field2|
Stats values(Field1 ) as fld1 values(Field2) as fld2
fyi - If I declare the calculated field expression explicitly in search as **eval field1 = expression** it is working 7.2.4 in fast and smart modes but not as a calculated field or filed aliases.
↧