topic Re: A new search field no longer shows in Interesting Fields to be selected in Splunk Search

A new search field no longer shows in Interesting Fields to be selected

Splunk2016 — Thu, 09 Apr 2015 20:46:57 GMT

I would appreciate any comments:

1) Added "Total" as one of my Selected Fields from the following search (this worked fine):

host="HP" sourcetype="csv" | eval ActionObligation1=tonumber(replace(ActionObligation,",","")) | eventstats sum(ActionObligation1) as Total | eval Total=if(Total>0,"$".tostring(Total,"commas"),"($".tostring(Total*-1,"commas").")")

2) Then I changed "Total" to "GrandTotal" and forgot to remove the previous "Total" from Selected Fields

host="HP" sourcetype="csv" | eval ActionObligation1=tonumber(replace(ActionObligation,",","")) | eventstats sum(ActionObligation1) as GrandTotal | eval GrandTotal=if(GrandTotal>0,"$".tostring(GrandTotal,"commas"),"($".tostring(GrandTotal*-1,"commas").")")

3) I then unchecked all Selected Fields
4) How do I get GrandTotal to appear in Interesting Fields? It no longer displays as an interesting new field. I tried changing back to Total and it no longer displays it under Interesting fields either.

Re: A new search field no longer shows in Interesting Fields to be selected

aljohnson_splun — Thu, 09 Apr 2015 21:11:34 GMT

Interesting fields are fields that have values in over 20% of the events that are returned from your search. The amount of fields you see in interesting fields can also depend on your search mode (fast mode does not perform field discovery). If you go to "All Fields", you can then search for your field or change the threshold. From there, you can also make the field selected, even if it isn't considered an "interesting" field.

Re: A new search field no longer shows in Interesting Fields to be selected

Splunk2016 — Thu, 09 Apr 2015 21:35:35 GMT

"All Fields" do not show the "GrandTotal" . Coverage option is 100%. if fast mode does not perform field discovery
why did "Total" showed before but it no longer shows up under interesting fields? There are over 8,000 events returned from the search. Perhaps something got changed and I need to reset my splunk environment. Thanks!

I think I see my issue. Coverage option should be changed to "All Fields". Now I can see "GrandTotal"! Thanks!