https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/227239#M67118 <P>Interesting fields only show up if there more that 20% of the events with that field. Having said that, what mode is your search set to? Interesting fields will not show in Fast mode. Try changing it to Smart or Verbose</P> Fri, 13 Nov 2015 17:27:51 GMT sundareshr 2015-11-13T17:27:51Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/227238#M67117 <P>I'm missing ALL of the interesting fields. </P> <P>I used to see such things as date_hour, date_minute, etc, etc. If I manually add those to the search, they show up in "Interesting Fields". <BR /> Same with my custom fields in <CODE>splunk/etc/apps/search/local/props.conf</CODE>. If I add them to the search, they'll show up under "Interesting Fields". </P> <P>If I go to "Extract New Fields", and click on a line, they show up as already defined.</P> Tue, 29 Sep 2020 07:52:09 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/227238#M67117 ajscam 2020-09-29T07:52:09Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/227239#M67118 <P>Interesting fields only show up if there more that 20% of the events with that field. Having said that, what mode is your search set to? Interesting fields will not show in Fast mode. Try changing it to Smart or Verbose</P> Fri, 13 Nov 2015 17:27:51 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/227239#M67118 sundareshr 2015-11-13T17:27:51Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/227240#M67119 <P>what a freaking life saver. i was on fast mode</P> Fri, 21 Feb 2020 07:10:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/227240#M67119 morethanyell 2020-02-21T07:10:46Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/585611#M204037 <P class="lia-align-left">thank you. i was on fast mode too.</P> Thu, 17 Feb 2022 17:32:35 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/585611#M204037 metennisman1988 2022-02-17T17:32:35Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/585619#M204038 <P>One way to see those even in fast mode is add “| fields *” after your 1st part. Is it wise or not is another story….</P> Thu, 17 Feb 2022 18:07:16 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-missing-all-quot-Interesting-Fields-quot-in-the-Search/m-p/585619#M204038 isoutamo 2022-02-17T18:07:16Z