topic Re: Disable Field Discovery in Splunk Search

Disable Field Discovery

Ron_Naken — Sun, 20 Mar 2011 00:56:21 GMT

In 4.2, we have the ability to click the Field Discovery button to ask Splunk to extract only necessary fields for a search -- similar to using a fields command, but automated. Is there a way to set this in the search syntax so that one could make saved searches -- or searches in knowledge objects -- that run in the OFF state, by default?

At present, if you click Field Discovery to OFF for a search, then save it, Field Discovery is re-enabled as soon as you run the saved search.

Thanks,
Ron

Re: Disable Field Discovery

Stephen_Sorkin — Sun, 20 Mar 2011 02:32:01 GMT

You can't change the toggle via the search language, but you can achieve the same effect by using "| fields ..." to pick only the fields that you care about for your search. This will give you the same speedup as disabling the automatic field extractor.

Re: Disable Field Discovery

gkanapathy — Sun, 20 Mar 2011 23:57:16 GMT

Note that the field discovery this affects searches in the flashtimeline view, but not scheduled saved searches or searches run on custom dashboards. Those searches do not do the automatic field discovery and in fact optimize out any non-required fields. You can do what you want as Stephen says, by using the fields command in the search string, but note that it's only needed on the flashtimeline view (or similar derivatives).