topic Re: How can we show all fields, including rare ones? in Splunk Search

How can we show all fields, including rare ones?

danielbb — Wed, 24 Jul 2019 17:38:07 GMT

I'm running -

index=<indexname> | fields

index=<indexname> | fieldsummary

They don't show the fields which are very rare in the content. Is there a way to see all fields even if they exist in a very small percentage of the events?

Re: How can we show all fields, including rare ones?

woodcock — Wed, 24 Jul 2019 18:12:06 GMT

The first command is utter nonsense but the 2nd command should already do exactly what you are asking. To make the first command "work" you should do this (but I wouldn't):

index=<> | rename _* AS INVISIBLE_* | table *

Re: How can we show all fields, including rare ones?

danielbb — Wed, 24 Jul 2019 18:25:03 GMT

I see, index=<indexname> | fieldsummary doesn't show the rare XXXPassword field, while index=<indexname> XXXPassword | fieldsummary does show this field.

Re: How can we show all fields, including rare ones?

danielbb — Thu, 25 Jul 2019 18:27:47 GMT

Not much luck with index=<indexname> | stats dc() as *

Re: How can we show all fields, including rare ones?

woodcock — Thu, 25 Jul 2019 23:08:20 GMT

You need to run your search in Verbose mode.

Re: How can we show all fields, including rare ones?

danielbb — Fri, 26 Jul 2019 13:43:44 GMT

No luck @woodcock - running in Verbose mode for the past 24 hours index=<indexname>| fieldsummary didn't show the field whereas index=<indexname> XXXPassword | fieldsummary shows it.

And as we said, XXXPassword is a rare field...