https://community.splunk.com/t5/Splunk-Search/Unable-to-get-results-for-Splunk-search-after-adding-a-field/m-p/362212#M106997 <P>A field can only be interesting if it occurs in at least 90X% (is it 95?) of all events in the returned results. The way to add it to the fields sidebar if it is NOT interesting is to add it to the Selected Fields list:<BR /> Click All Fields.<BR /> The Select Fields dialog box shows a list of fields in your events and ALL fields will be shown.<BR /> The # of Values column shows the number of unique values for each field in the events.<BR /> Search for your field name and click the checkbox next to it.<BR /> Click save.</P> <P>You can also click the &gt; icon icon next to your event under the i header on the events tab to turn it into a v and this will show you ALL fields for that event, even the ones that are not interesting.</P> Thu, 10 Aug 2017 21:09:54 GMT mhouse3 2017-08-10T21:09:54Z https://community.splunk.com/t5/Splunk-Search/Unable-to-get-results-for-Splunk-search-after-adding-a-field/m-p/362211#M106996 <P>I am unable to get any values for my search when I add a field from the interesting fields list. It is happening only for one field and that particular field does have results.</P> <P>ex: <BR /> Consider I have a following field value pair in my event "name = xyz". </P> <PRE><CODE>"index=abc name xyz", "index=abc name"," index=abc xyz" </CODE></PRE> <P>gives me the results for this search, but not for <CODE>index=abc name=xyz or index=abc name="xyz".</CODE><BR /> Can anyone help me with this and let me know how to resolve this issue?</P> Thu, 10 Aug 2017 20:32:59 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-get-results-for-Splunk-search-after-adding-a-field/m-p/362211#M106996 rangineniarunku 2017-08-10T20:32:59Z https://community.splunk.com/t5/Splunk-Search/Unable-to-get-results-for-Splunk-search-after-adding-a-field/m-p/362212#M106997 <P>A field can only be interesting if it occurs in at least 90X% (is it 95?) of all events in the returned results. The way to add it to the fields sidebar if it is NOT interesting is to add it to the Selected Fields list:<BR /> Click All Fields.<BR /> The Select Fields dialog box shows a list of fields in your events and ALL fields will be shown.<BR /> The # of Values column shows the number of unique values for each field in the events.<BR /> Search for your field name and click the checkbox next to it.<BR /> Click save.</P> <P>You can also click the &gt; icon icon next to your event under the i header on the events tab to turn it into a v and this will show you ALL fields for that event, even the ones that are not interesting.</P> Thu, 10 Aug 2017 21:09:54 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-get-results-for-Splunk-search-after-adding-a-field/m-p/362212#M106997 mhouse3 2017-08-10T21:09:54Z https://community.splunk.com/t5/Splunk-Search/Unable-to-get-results-for-Splunk-search-after-adding-a-field/m-p/362213#M106998 <P>The problem with that particular field is it is not returning any values once I select it to the search query, but it is assigned with few values from the logs. I am not caring whether it is in selected fields or Interesting fields set. Is there any way I can set the extraction properly so that I can get the results once I select it?</P> Thu, 10 Aug 2017 21:15:25 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-get-results-for-Splunk-search-after-adding-a-field/m-p/362213#M106998 rangineniarunku 2017-08-10T21:15:25Z