Splunk Search

How to see all discovered fields

sdev
Engager

Hi
I have added a cisco syslog as a syslog type. I have field discovery on. It shows 59 fields.
When I select pick fields in the UI, available fields are only 20
How do I see all fields?

Thanks!

Tags (2)

paddygriffin
Path Finder

I believe the min_freq entry in limits.conf controls this but haven't had a chance to test. Assuming it does, the entry would look something like
min_freq = 0.0001
* Minimum frequency of a field required for including in the /summary endpoint as a fraction (>=0 and <=1).
* Defaults is 0.01 (1%)

0 Karma

paddygriffin
Path Finder

Great clarification/ correction. Thanks!

0 Karma

sideview
SplunkTrust
SplunkTrust

This is related but quite different. To see the difference, search in "index=_internal". Open the FieldPicker, and set that "1" in the form field to "0". Sort by "%" ascending, and you'll see a bunch of fields with <1% frequency. You'll see that all these fields however, if you click the tiny chart icon, it says they "have no summary information". The value set in the Field Picker's form field concerns whether they show up in the Field Picker's list. The value in limits.conf concerns whether there's actual "top 10 values" summary data.

0 Karma

sdev
Engager

Thanks very much!! That worked

0 Karma

sideview
SplunkTrust
SplunkTrust

yea, it's a bit of a strange design and this confuses people a lot. Note that when you open the big field picker control, that it has a little textfield at the top, on the left side. This textfield has a "%" symbol above it, and it'll have the number "1" in it. This strange little box is actually filtering the displayed fields according to the fields representation across the events.

In other words, when it says "1", which is the default, it will only show you the fields that are present in at least 1% of the events. Change it to 0 and you'll see all 59 fields.

sideview
SplunkTrust
SplunkTrust

Although that would make sense, there's no param on the FieldPicker module to do so. You could write a little javascript to patch the module, but this is a pretty advanced thing to do.

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

Is there a way to make this a default. Maybe in the advanced XML?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...