topic How to get default fields after using eval in Dashboards & Visualizations

How to get default fields after using eval

Jasmine — Sun, 12 Nov 2023 14:48:41 GMT

How to get default fields like host app,servie after using eval.

after using eval, i am not able to fetch any default fields. please advise.

Re: How to get default fields after using eval

inventsekar — Sun, 12 Nov 2023 15:03:43 GMT

Hi @Jasmine .. We may need more details from you.

Please update us your current Splunk Search query (remove any hostnames, ip address, etc before posting it here)

Re: How to get default fields after using eval

tscroggins — Sun, 12 Nov 2023 17:06:04 GMT

Hi @Jasmine,

"app" and "servie" are not default Splunk fields, although they may be extracted in your search context.

If you're using the search interface to explore data, make sure you're running searches in "Smart Mode" (preferably) or "Verbose Mode." The mode selector is just below the magnifying glass search button.