Splunk Search

Why am I missing all "Interesting Fields" in the Search & Reporting screen?

ajscam
Engager

I'm missing ALL of the interesting fields.

I used to see such things as date_hour, date_minute, etc, etc. If I manually add those to the search, they show up in "Interesting Fields".
Same with my custom fields in splunk/etc/apps/search/local/props.conf. If I add them to the search, they'll show up under "Interesting Fields".

If I go to "Extract New Fields", and click on a line, they show up as already defined.

1 Solution

sundareshr
Legend

Interesting fields only show up if there more that 20% of the events with that field. Having said that, what mode is your search set to? Interesting fields will not show in Fast mode. Try changing it to Smart or Verbose

View solution in original post

sundareshr
Legend

Interesting fields only show up if there more that 20% of the events with that field. Having said that, what mode is your search set to? Interesting fields will not show in Fast mode. Try changing it to Smart or Verbose

metennisman1988
Engager

thank you. i was on fast mode too.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

One way to see those even in fast mode is add “| fields *” after your 1st part. Is it wise or not is another story….

0 Karma

morethanyell
Builder

what a freaking life saver. i was on fast mode

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...