Splunk Search

Why am I missing all "Interesting Fields" in the Search & Reporting screen?

ajscam
Engager

I'm missing ALL of the interesting fields.

I used to see such things as date_hour, date_minute, etc, etc. If I manually add those to the search, they show up in "Interesting Fields".
Same with my custom fields in splunk/etc/apps/search/local/props.conf. If I add them to the search, they'll show up under "Interesting Fields".

If I go to "Extract New Fields", and click on a line, they show up as already defined.

1 Solution

sundareshr
Legend

Interesting fields only show up if there more that 20% of the events with that field. Having said that, what mode is your search set to? Interesting fields will not show in Fast mode. Try changing it to Smart or Verbose

View solution in original post

sundareshr
Legend

Interesting fields only show up if there more that 20% of the events with that field. Having said that, what mode is your search set to? Interesting fields will not show in Fast mode. Try changing it to Smart or Verbose

metennisman1988
Engager

thank you. i was on fast mode too.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

One way to see those even in fast mode is add “| fields *” after your 1st part. Is it wise or not is another story….

0 Karma

morethanyell
Builder

what a freaking life saver. i was on fast mode

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...