https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129453#M35216 <P>Do you mean on your search results?</P> <P>If so - On the left hand side is a panel that says "Fields", scroll to the bottom and it'll say "All Fields" Click that and it will bring up a list of all fields on that event. Select the tickbox and clicks save and it will show up.</P> <P>If not - and you're trying to search for the field, as long as it exists, a simple </P> <P><CODE>search ... | where app = "sencer"</CODE></P> <P>Should do the trick</P> Tue, 07 Apr 2015 14:25:06 GMT markthompson 2015-04-07T14:25:06Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129452#M35215 <P>How to get the details of field app=sencer, when it not shown in the values for the app field?</P> Tue, 07 Apr 2015 14:18:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129452#M35215 moiezuddin 2015-04-07T14:18:03Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129453#M35216 <P>Do you mean on your search results?</P> <P>If so - On the left hand side is a panel that says "Fields", scroll to the bottom and it'll say "All Fields" Click that and it will bring up a list of all fields on that event. Select the tickbox and clicks save and it will show up.</P> <P>If not - and you're trying to search for the field, as long as it exists, a simple </P> <P><CODE>search ... | where app = "sencer"</CODE></P> <P>Should do the trick</P> Tue, 07 Apr 2015 14:25:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129453#M35216 markthompson 2015-04-07T14:25:06Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129454#M35217 <P>im trying to search for the field</P> <P>index=casm_prod sourcetype=smtrace | where app = "sencer"</P> <P>Not result, but i can see anthor application listed in app values except "sencer"</P> Tue, 07 Apr 2015 14:33:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129454#M35217 moiezuddin 2015-04-07T14:33:17Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129455#M35218 <P>try putting it in brackets WHERE (app="sencer")</P> Tue, 07 Apr 2015 14:43:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129455#M35218 markthompson 2015-04-07T14:43:00Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129456#M35219 <P>Also, be aware that you should use the table function inbetween, as it creates an output.</P> Tue, 07 Apr 2015 14:43:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129456#M35219 markthompson 2015-04-07T14:43:44Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129457#M35220 <P>As a shorter way, just include it in your original search <CODE>index=casm_prod sourcetype=smtrace app=sencer</CODE></P> Tue, 07 Apr 2015 14:45:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-details-of-a-field-value-that-does-not-appear-in/m-p/129457#M35220 markthompson 2015-04-07T14:45:00Z