We have this same issue. Our product uses the Java SDK to execute a saved search. If we don't mention the name of the field in the search, then we get no data for that field despite it showing up in the Splunk UI. We tried doing things like "| field " at the end but that causes the performance to fall off a cliff. The only solution seems to be to put "field1= field2=*" etc at the end of the query, which of course means our customers MUST modify the saved searches they want to use with our product. This is a bit unfriendly.
... View more