https://community.splunk.com/t5/Splunk-Dev/How-to-get-extracted-fields-when-searching-using-the-REST-API/m-p/630893#M10932 <P>When I search using the Python SDK, I don't seem to see any fields, other than the very basic ones like host, source, sourcetype... in the results. Is there a way to get the search to return all the same pre-extracted fields I get when using the splunk search GUI ? like fields automatically extracted by Splunk, such as those that come in field1=value1 ...etc?</P><P>Thanks,</P><P>Mohamed.</P> Wed, 15 Feb 2023 01:05:39 GMT mlrhazi 2023-02-15T01:05:39Z https://community.splunk.com/t5/Splunk-Dev/How-to-get-extracted-fields-when-searching-using-the-REST-API/m-p/630893#M10932 <P>When I search using the Python SDK, I don't seem to see any fields, other than the very basic ones like host, source, sourcetype... in the results. Is there a way to get the search to return all the same pre-extracted fields I get when using the splunk search GUI ? like fields automatically extracted by Splunk, such as those that come in field1=value1 ...etc?</P><P>Thanks,</P><P>Mohamed.</P> Wed, 15 Feb 2023 01:05:39 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-extracted-fields-when-searching-using-the-REST-API/m-p/630893#M10932 mlrhazi 2023-02-15T01:05:39Z https://community.splunk.com/t5/Splunk-Dev/How-to-get-extracted-fields-when-searching-using-the-REST-API/m-p/630904#M10933 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/253904">@mlrhazi</a>,</P><P>Splunk REST API does not extract fields like GUI. You should specify the required fields by <STRONG>rf</STRONG>&nbsp;(or required_fields on older versions) parameter. Please see the below documentation.&nbsp;</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.0.3/RESTTUT/RESTsearches#Tips_on_creating_searches" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.3/RESTTUT/RESTsearches#Tips_on_creating_searches</A></P><P>&nbsp;</P> Wed, 15 Feb 2023 05:06:34 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-extracted-fields-when-searching-using-the-REST-API/m-p/630904#M10933 scelikok 2023-02-15T05:06:34Z https://community.splunk.com/t5/Splunk-Dev/How-to-get-extracted-fields-when-searching-using-the-REST-API/m-p/752785#M12052 <P>rf=* for all fields</P> Mon, 08 Sep 2025 01:25:59 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-get-extracted-fields-when-searching-using-the-REST-API/m-p/752785#M12052 soiram 2025-09-08T01:25:59Z