topic Re: Why is one interesting field not always displayed, and what change do we need to make to have this field always appear by default? in Splunk Search

Why is one interesting field not always displayed, and what change do we need to make to have this field always appear by default?

sivapuvvada — Mon, 06 Jun 2016 17:32:25 GMT

I am not always getting one interesting field, even though I have selected all fields from the fields bar on the left side.

How does Splunk extract interesting fields by default? Where do we need to make a change if we want to always see this interesting field by default?

Re: Why is one interesting field not always displayed, and what change do we need to make to have this field always appear by default?

kbarker302 — Mon, 06 Jun 2016 18:17:34 GMT

What mode are you searching in? (See the dropdown list on the right under the search icon.) Interesting fields do not show up in Fast Mode - they only show up in Smart or Verbose Mode. I'm not sure if there's a way to make them show up by default.

Re: Why is one interesting field not always displayed, and what change do we need to make to have this field always appear by default?

woodcock — Tue, 07 Jun 2016 12:35:06 GMT

You cannot make a field more interesting without making it more common (frequently occurring in your events). You can however make it a Selected field and then it will always appear. Do it like this:

Perform a search where the field exists for at least 1 search.
Click on All Fields in the upper right of the Fields area (left side of screen under timeline).
Type your field name into the Filter box in the Field Picker dialog that opens.
Mark/Select the checkbox next to your Field Name.
Dismiss the Field Picker dialog.

Now your field will show in the Selected Fields list and also underneath each event (as long as you are in List or Table mode).

Re: Why is one interesting field not always displayed, and what change do we need to make to have this field always appear by default?

pkumar9610 — Tue, 06 Aug 2019 10:00:26 GMT

@woodcock : When I click on All fields I see only 6 Fields on Search Head, what do I need to do to get all the fields back ?

I have raised issue in: https://answers.splunk.com/answers/763583/interesting-fields-missing-in-searchreporting-app.html?minQuestionBodyLength=80

Re: Why is one interesting field not always displayed, and what change do we need to make to have this field always appear by default?

woodcock — Tue, 06 Aug 2019 14:56:50 GMT

The splunk settings that are causing the fields to exist are probably owned by those other apps but the permissions are set to App. You need to edit the permissions and change them to Global (AKA All Apps) so that it will take effect in any app.