topic Re: How to see all discovered fields in Splunk Search

How to see all discovered fields

sdev — Sat, 09 Jul 2011 01:27:53 GMT

Hi
I have added a cisco syslog as a syslog type. I have field discovery on. It shows 59 fields.
When I select pick fields in the UI, available fields are only 20
How do I see all fields?

Thanks!

Re: How to see all discovered fields

sideview — Sat, 09 Jul 2011 05:27:06 GMT

yea, it's a bit of a strange design and this confuses people a lot. Note that when you open the big field picker control, that it has a little textfield at the top, on the left side. This textfield has a "%" symbol above it, and it'll have the number "1" in it. This strange little box is actually filtering the displayed fields according to the fields representation across the events.

In other words, when it says "1", which is the default, it will only show you the fields that are present in at least 1% of the events. Change it to 0 and you'll see all 59 fields.

Re: How to see all discovered fields

sdev — Sat, 09 Jul 2011 06:26:50 GMT

Thanks very much!! That worked

Re: How to see all discovered fields

bmunson_splunk — Mon, 22 Jul 2013 11:02:27 GMT

Is there a way to make this a default. Maybe in the advanced XML?

Re: How to see all discovered fields

sideview — Mon, 22 Jul 2013 16:06:05 GMT

Although that would make sense, there's no param on the FieldPicker module to do so. You could write a little javascript to patch the module, but this is a pretty advanced thing to do.

Re: How to see all discovered fields

paddygriffin — Mon, 28 Sep 2020 14:24:53 GMT

I believe the min_freq entry in limits.conf controls this but haven't had a chance to test. Assuming it does, the entry would look something like
min_freq = 0.0001
* Minimum frequency of a field required for including in the /summary endpoint as a fraction (>=0 and <=1).
* Defaults is 0.01 (1%)

Re: How to see all discovered fields

sideview — Tue, 23 Jul 2013 22:30:44 GMT

This is related but quite different. To see the difference, search in "index=_internal". Open the FieldPicker, and set that "1" in the form field to "0". Sort by "%" ascending, and you'll see a bunch of fields with <1% frequency. You'll see that all these fields however, if you click the tiny chart icon, it says they "have no summary information". The value set in the Field Picker's form field concerns whether they show up in the Field Picker's list. The value in limits.conf concerns whether there's actual "top 10 values" summary data.

Re: How to see all discovered fields

paddygriffin — Tue, 23 Jul 2013 22:46:43 GMT

Great clarification/ correction. Thanks!