Metadata Missing

Comments

2 comments

  • Avatar
    Sumner Burkart

    Hi Vipin,

    Are you using the nodrop operator in your parse statement?

    Please check out: https://help.sumologic.com/Search/Search_Query_Language/01_Parse_Operators/Parse_nodrop_option

     

     

    0
    Comment actions Permalink
  • Avatar
    Vipul Verma

    Hi Vipin,

    I think by 'Scheduled Query' you mean 'Scheduled View'. For aggregate scheduled views, the results do not have message field and other metadata like sourceHost, sourceCategory hence those fields are empty.

     

    There is an aha idea which talks about supporting extracted fields (via Field Extraction) and generated fields (via Scheduled Views) in data forwarding. Please vote on that Idea. Our product team keeps looking these idea and will try to put them in future roadmap.

     

    Thanks

    Vipul

    0
    Comment actions Permalink

Please sign in to leave a comment.