Support for generating commands

When you set up searches with field filters, keep in mind that field filters only supports searches that use one of the following generating commands:

  • search
  • tstats
  • typeahead
  • walklex
This means that the first command in the search string must be search, tstats, typeahead, or walklex. For example, the field filter is not applied in the following search because it uses inputcsv, which is an unsupported generating command:
CODE 
| inputcsv ... | search ...
However, the field filter is applied in the following search:
CODE 
index=main | ....
Technically, the search command comes first in the pipeline, but doesn't actually need to be specified because it is implied. See Generating commands in the Search Reference.

Adding new fields

Don't use field filters to add new fields at search time. Use calculated fields for this purpose. See About calculated fields in the Knowledge Manager Manual.