Splunk Search

How to see all discovered fields

sdev
Engager

Hi
I have added a cisco syslog as a syslog type. I have field discovery on. It shows 59 fields.
When I select pick fields in the UI, available fields are only 20
How do I see all fields?

Thanks!

Tags (2)

paddygriffin
Path Finder

I believe the min_freq entry in limits.conf controls this but haven't had a chance to test. Assuming it does, the entry would look something like
min_freq = 0.0001
* Minimum frequency of a field required for including in the /summary endpoint as a fraction (>=0 and <=1).
* Defaults is 0.01 (1%)

0 Karma

paddygriffin
Path Finder

Great clarification/ correction. Thanks!

0 Karma

sideview
SplunkTrust
SplunkTrust

This is related but quite different. To see the difference, search in "index=_internal". Open the FieldPicker, and set that "1" in the form field to "0". Sort by "%" ascending, and you'll see a bunch of fields with <1% frequency. You'll see that all these fields however, if you click the tiny chart icon, it says they "have no summary information". The value set in the Field Picker's form field concerns whether they show up in the Field Picker's list. The value in limits.conf concerns whether there's actual "top 10 values" summary data.

0 Karma

sdev
Engager

Thanks very much!! That worked

0 Karma

sideview
SplunkTrust
SplunkTrust

yea, it's a bit of a strange design and this confuses people a lot. Note that when you open the big field picker control, that it has a little textfield at the top, on the left side. This textfield has a "%" symbol above it, and it'll have the number "1" in it. This strange little box is actually filtering the displayed fields according to the fields representation across the events.

In other words, when it says "1", which is the default, it will only show you the fields that are present in at least 1% of the events. Change it to 0 and you'll see all 59 fields.

sideview
SplunkTrust
SplunkTrust

Although that would make sense, there's no param on the FieldPicker module to do so. You could write a little javascript to patch the module, but this is a pretty advanced thing to do.

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

Is there a way to make this a default. Maybe in the advanced XML?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...