Searching using a field extraction rule field fails when used AFTER json auto

Comments

1 comment

  • Official comment
    Avatar
    Raghu Murthy

    Devon,

     

    Thanks for bringing this to our attention this issue with the "json auto" operator where it overrides a FER extracted field value with a null value for a field that does not exist in the raw message. We are addressing this issue shortly

     

    Best,

    Raghu

    Sumo Logic Inc.

Please sign in to leave a comment.