topic Re: How to get logs to show fieldnames in Splunk Search

How to get logs to show fieldnames

NJ — Thu, 23 Mar 2023 01:09:43 GMT

Hi everyone!

I'm still fairly new to Splunk so sorry if it is a simple question.

I have some logs that does not show the field names when you have done a search.

But when I expand the event, I can see the names.

Is it not possible to have the field names shown in the first picture?

Re: How to get logs to show fieldnames

yeahnah — Thu, 23 Mar 2023 02:36:40 GMT

Hi @NJ

The List view will just show you what the event data looks like as it was ingested. There obviously must be some automatic field extraction going on for the field values to be extracted.

If you want column headers (field names) to show with the values underneath, then you can pick the table view instead

Whatever you have as Selected Fields will show as a column with the value underneath.

You can select or deselect fields by clicking into them.

Another method, though is to use the table command

...your search ... | table *

You can specify the field names you want or just use the * wildcard for everything.

Hope this helps. Please mark as solution provided if this answer your query.

Re: How to get logs to show fieldnames

NJ — Thu, 23 Mar 2023 03:13:09 GMT

Hi @yeahnah

Thanks for your reply learned something new!

However, is there no way to get it like this JSON example:

Re: How to get logs to show fieldnames

yeahnah — Thu, 23 Mar 2023 03:54:02 GMT

Yes, you can do that using a search command, like this

... your base search ...
| fields *
| tojson

Re: How to get logs to show fieldnames

gcusello — Thu, 23 Mar 2023 05:22:06 GMT

Hi @NJ ,

are you using Verbose or Smart Mode in your search?

you have to use Verbose Mode to display all the extracted fields.

if you have in interesting fields less fields than all fields the reason is that probably you have less results than 20%, so they aren't visualized in interesting fields.

Ciao.

Giuseppe

Re: How to get logs to show fieldnames

PickleRick — Thu, 23 Mar 2023 05:30:25 GMT

Just be aware that you're not showing the original event anymore - just some rendered json structure.

Re: How to get logs to show fieldnames

NJ — Thu, 23 Mar 2023 05:35:00 GMT

Hi @gcusello

I can see the field names on the left side but I was wondering if I would be able to see them in the event list like this:

Field name: Value

Re: How to get logs to show fieldnames

gcusello — Thu, 23 Mar 2023 06:00:33 GMT

Hi @NJ ,

you can visualize logs in raw text mode.

If you want to visualize them in json format, you have to manually open each of them, for my knowledge there isn't an option to open all the sub parts of the log.

Ciao.

Giuseppe