Fields through REST API

klbiggs — Tue, 07 Jun 2011 18:44:39 GMT

When using the REST API through a Java application I only receive fields that I explicitly search for (e.g. "5109483394 | fields Number, Location, LogType"). I have set up these fields in transforms.conf and this works using the Search app without having to specifically search for the fields (e.g "5109483394"). Is there anyway to set this fields to show up without directly searching for them?

Re: Fields through REST API

sideview — Mon, 28 Sep 2020 09:39:25 GMT

Splunk will not extract or persist fields by default if the search parser tells it that the given fields are not referenced in the search language anywhere.

You can of course trigger the extraction by tacking on a fields command as you've discovered:

<your search> | fields someDesiredField anotherDesiredField

As far as a more general solution, you can tack on fields * to tell it to extract every field.

And at the API level, you can also send required_field_list=* on the POST when you dispatch the job.

Be aware that when you search with fields * or submit with the API arg required_field_list set to *, your searches will incur a what can be a significant performance drain, as every possible extraction will be run.

(as to why the default search UI always has every field, the presence of the FieldPicker module in the view XML triggers a change to where all searches get dispatched with the REST arg required_field_list=*. To come full circle, when you turn off 'automatic field discovery' in the UI, what's happening is it then falls back to submitting required_field_list=<just the selected fields please>)

In general if you're using the REST API you really should become as familiar with status_buckets and required_field_list sooner rather than later because behavior can be quite counterintuitive.

http://www.splunk.com/base/Documentation/4.2.1/Developer/RESTSearch

topic Re: Fields through REST API in Splunk Search

Fields through REST API

Re: Fields through REST API