topic Re: SELECTED FIELDS in Getting Data In

SELECTED FIELDS

fridays — Wed, 13 Feb 2019 16:09:05 GMT

How to add fields to "selected fields" from the event. Some fields, such as name and sc_pl, are missing in the selected fields.

Re: SELECTED FIELDS

MoniM — Thu, 14 Feb 2019 05:22:26 GMT

Hi fridays,
you can go to "All Fields" and from there you can select the required fields of your interest(check the box for the field you want).

Hope it helps!
Thanks

Re: SELECTED FIELDS

woodcock — Thu, 14 Feb 2019 07:04:58 GMT

Click on the All Fields link in the left-most panel under the histogram. Any field that has a checkmark will be a SELECTED FIELD.

Re: SELECTED FIELDS

fridays — Thu, 14 Feb 2019 08:53:48 GMT

"All fields" - do not include all fields. No serv, name and other fields.

Re: SELECTED FIELDS

woodcock — Thu, 14 Feb 2019 09:33:48 GMT

It is relatively dynamic and will only show those fields that exist in your current search results. To get those other fields available, run a search that returns results with those fields (or just do something like | eval serv = "foo".

Re: SELECTED FIELDS

MoniM — Thu, 14 Feb 2019 09:57:22 GMT

Hi @fridays ,
One of the reason for this is the coverage percentage.
please find below snap for the setting in your "All Fields tab".

Re: SELECTED FIELDS

nikita_p — Thu, 14 Feb 2019 09:59:00 GMT

Hi Fridays,
How are you searching your fields?
If you want to see all selected fields you need to search it in verbose mode and also make sure the coverage selected is "All Fields"

Re: SELECTED FIELDS

fridays — Thu, 14 Feb 2019 15:37:35 GMT

In screensot select All fields. And no filters

Re: SELECTED FIELDS

fridays — Thu, 14 Feb 2019 15:47:04 GMT

This is All Fields. In splunk 6.5 all fields were in place. The problem appeared after the update on the splank 7.2.4

Re: SELECTED FIELDS

fridays — Thu, 14 Feb 2019 16:22:24 GMT

no fields.

Re: SELECTED FIELDS

MoniM — Fri, 15 Feb 2019 05:29:35 GMT

I am not sure if this will work for you or not. You can try by deleting the Field Aliases.

Below is the answer for the same issue:-
https://answers.splunk.com/answers/693737/splunk-720-field-aliases-incorrect-behavior.html